CVE-2020-15303 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 59%

Affected Products (NVD)

Vendor	Product	Version
infoblox	nios	8.4.0 ≤ 𝑥 ≤ 8.4.8
infoblox	nios	8.5.0
infoblox	nios	8.5.1

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The software uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References

https://community.infoblox.com/t5/Security/NIOS-XML-Vulnerability/m-p/22437#M1995

https://www.infoblox.com/products/nios8/

https://community.infoblox.com/t5/Security/NIOS-XML-Vulnerability/m-p/22437#M1995

https://www.infoblox.com/products/nios8/