CVE-2018-11048

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Dell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 contain a XML External Entity (XXE) Injection vulnerability in the REST API. An authenticated remote malicious user could potentially exploit this vulnerability to read certain system files in the server or cause denial of service by supplying specially crafted Document Type Definitions (DTDs) in an XML request.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
Dell EMC	Data Protection Advisor	6.2; 6.3; >= 6.4, <= patch B180; >= 6.5, <= patch B58
Dell EMC	Integrated Data Protection Appliance	2.0; 2.1

References

http://seclists.org/fulldisclosure/2018/Aug/5Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/105130Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041417Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Aug/5Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/105130Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041417Third Party Advisory, VDB Entry

Timeline

Published: Aug 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-110497.3RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The CVE-2018-110508.8Dell EMC NetWorker versions between 9.0 and 9.1.1.8 through 9.2.1.3, and the version 18.1.0.1 contain a Clear-Text authentication over netwo CVE-2018-110517.5RSA Certificate Manager Versions 6.9 build 560 through 6.9 build 564 contain a path traversal vulnerability in the RSA CMP Enroll Server and CVE-2018-110529.8Dell EMC ECS versions 3.2.0.0 and 3.2.0.1 contain an authentication bypass vulnerability. A remote unauthenticated attacker could exploit th CVE-2018-110536.5Dell EMC iDRAC Service Module for all supported Linux and XenServer versions v3.0.1, v3.0.2, v3.1.0, v3.2.0, when started, changes the defau CVE-2018-110547.5RSA BSAFE Micro Edition Suite, version 4.1.6, contains an integer overflow vulnerability. A remote attacker could use maliciously constructe CVE-2018-110555.5RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x), contains an Improper Clearing of Heap Me CVE-2018-110566.5RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 (in 4.0.x) contai CVE-2018-110575.9RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6.1 (in 4.1.x) contains a Covert Timing Channel vulnerab CVE-2018-110589.8RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition, vers CVE-2018-110595.4RSA Archer, versions prior to 6.4.0.1, contain a stored cross-site scripting vulnerability. A remote authenticated malicious Archer user cou CVE-2018-11065.5An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signe