Vulnerability Details : CVE-2018-13416
In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running UMS, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.
Vulnerability category: XML external entity (XXE) injection
Products affected by CVE-2018-13416
- cpe:2.3:a:spirton:universal_media_server:7.1.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-13416
2.22%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 89 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-13416
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2018-13416
-
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-13416
-
http://seclists.org/fulldisclosure/2018/Jul/94
Full Disclosure: Out-of-Band XXE in Universal Media Server's SSDP ProcessingMailing List;Third Party Advisory
-
https://www.exploit-db.com/exploits/45133/
Universal Media Server 7.1.0 - SSDP Processing XML External Entity InjectionExploit;Third Party Advisory;VDB Entry
Jump to