High ICSA-18-151-02 3 CVEs

GE MDS PulseNET and MDS PulseNET Enterprise

Published May 31, 2018 · Updated May 31, 2018

Vendor: General Electric (GE) Product: PulseNET Product: PulseNET Enterprise

Summary

Exploitation of these vulnerabilities may allow elevation of privilege and exfiltration of information on the host platform.

Vulnerabilities 3

Unscored —

CVE-2018-10611

Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior m…

GE MDS PulseNET and MDS PulseNET Enterprise

Jun 4, 2018
Unscored —

CVE-2018-10613 EPSS 18%

Multiple variants of XML External Entity (XXE) attacks may be used to exfiltrate data from the host Windows platform in…

GE MDS PulseNET and MDS PulseNET Enterprise

Jun 4, 2018
Unscored —

CVE-2018-10615

Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise v…

GE MDS PulseNET and MDS PulseNET Enterprise

Jun 4, 2018

Revision history

2018-05-31 #1
ICSA-18-151-02 GE MDS PulseNET and MDS PulseNET Enterprise

References

ICS Advisory ICSA-18-151-02 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-18-151-02
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/news-events/ics-advisories/icsa-18-151-02
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf