Skip to content
OpenAdvisories
Unscored Public exploit CVE-2019-8997 EUVD-2019-18384GHSA-f476-4rjp-2jx3

An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-56…

Published Mar 21, 2019 · Updated Aug 4, 2024 · Assigned by blackberry

Description

An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an attacker to potentially read arbitrary local files from the application server or make requests on the network by entering maliciously crafted XML in an existing field.

Affected products

VendorProductAffectedFixed
— BlackBerry AtHoc 7.6 and earlier —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • nxkennedy/CVE-2019-8997 ★ 2 · Apr 18, 2019

    An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an attacker to potentially read arbitrary loca…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References