CVE-2019-11216

BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality

published December 4, 2019

CVSS
—
EPSS
2%
Percentile
78.8
In the wild
Unconfirmed
What it is

BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to download local files from the server, or do DoS attacks with XML expansion attacks. XXE with direct response and XXE OOB are allowed.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01835 · 78.8th percentile
Published
2019-12-04T19:31Z
EPSS history
Timeline
  • 04 DEC 19:31Z
    BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality
    cvelistv5