CVE-2019-8997

An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an attacker to potentially read arbitrary local files from the application server or make requests on the network by entering maliciously crafted XML in an existing field.

CVSS v3.0

5.9 MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS

2.32% chance of exploitation in the next 30 days, 82th percentile

Published

2019-03-21

Updated

2024-08-04

Proof-of-concept exploits (1)

• nxkennedy/CVE-2019-89972★ · 2020-02-04

References

• CVE Record
• NVD entry

Related

• CVE-2019-8985
• CVE-2019-9002
• CVE-2019-8982
• CVE-2019-9017
• CVE-2019-8981
• CVE-2019-9019