CVE-2019-19144

NVD	https://nvd.nist.gov/vuln/detail/CVE-2019-19144
CWE	https://cwe.mitre.org/data/definitions/776.html

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-19144

CWE

https://cwe.mitre.org/data/definitions/776.html

XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 (11449-53631 Build304) devices via rest/Users?action=authenticate.

Weakness

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Potential Mitigations

https://cwe.mitre.org/data/definitions/197.html

References

https://github.com/atredispartners/advisories/blob/master/ATREDIS-2019-0004.md
https://www.quantum.com/products/disk-basedbackup/dxi6700/index.aspx
https://github.com/atredispartners/advisories/blob/master/ATREDIS-2019-0004.md

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Weakness

Potential Mitigations

Related Attack Patterns

References