The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
Weakness
The product accepts XML from an untrusted source but does not validate the XML against the proper schema.
Affected Software
| Name |
Vendor |
Start Version |
End Version |
| Bigfix_mobile |
Hcltech |
1.0 (including) |
2.1 (excluding) |
| Modern_client_management |
Hcltech |
1.0 (including) |
2.1 (excluding) |
Potential Mitigations
- Always validate XML input against a known XML Schema or DTD.
- It is not possible for an XML parser to validate all aspects of a document’s content because a parser cannot understand the complete semantics of the data. However, a parser can do a complete and thorough job of checking the document’s structure and therefore guarantee to the code that processes the document that the content is well-formed.
References