CVE-2017-13706

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

XML external entity (XXE) vulnerability in the import package functionality of the deployment module in Lansweeper before 6.0.100.67 allows remote authenticated users to obtain sensitive information, cause a denial of service, conduct server-side request forgery (SSRF) attacks, conduct internal port scans, or have unspecified other impact via an XML request, aka bug #572705.

Metrics

CVSS 3.0 9.9/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/144527/Lansweeper-6.0.100.29-XXE-Injection.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2017/Oct/14Mailing List, Third Party Advisory
https://www.lansweeper.com/changelog.aspxRelease Notes, Vendor Advisory
http://packetstormsecurity.com/files/144527/Lansweeper-6.0.100.29-XXE-Injection.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2017/Oct/14Mailing List, Third Party Advisory
https://www.lansweeper.com/changelog.aspxRelease Notes, Vendor Advisory

Timeline

Published: Oct 10, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-137079.8Privilege escalation in Replibit Backup Manager earlier than version 2017.08.04 allows attackers to gain root privileges via sudo command ex CVE-2017-137089.8Buffer overflow in the web server service in VX Search Enterprise 10.0.14 allows remote attackers to execute arbitrary code via a crafted GE CVE-2017-137097.5In FlightGear before version 2017.3.1, Main/logger.cxx in the FGLogger subsystem allows one to overwrite any file via a resource that affect CVE-2017-13718.8Builder tools running in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated u CVE-2017-137107.5The setup_group function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remo CVE-2017-137117.5Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of ser CVE-2017-137127.5NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of S CVE-2017-137138.8T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to cgi-bi CVE-2017-137159.8The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel before 4.3 does not ensure that n_proto, ip_proto, and thof CVE-2017-137165.5The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial CVE-2017-137178.8Starry Station (aka Starry Router) sets the Access-Control-Allow-Origin header to "*". This allows any hosted file on any domain to make cal CVE-2017-137188.0The HTTP API supported by Starry Station (aka Starry Router) allows brute forcing the PIN setup by the user on the device, and this allows a