Description
NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity (XXE) injection vulnerability in XML preference import settings. Attackers can craft malicious XML files with DTD parameter entities to retrieve arbitrary system files through an out-of-band channel attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NovaRad | NovaPACS Diagnostics Viewer | 8.5.19.75 | — |
References
- ExploitDB-45337 exploit
- NovaRad Corporation Product Homepage product
- Zero Science Lab Disclosure (ZSL-2018-5488) third-party-advisory