9.8crit
CVE-2018-10600
SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser, which may allow disclosure an…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.5%
percentile 85%
Public exploits
0
none known
Summary
SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser, which may allow disclosure and retrieval of arbitrary data, arbitrary code execution (in certain situations on specific platforms), and denial of service attacks.
Exploit prediction (EPSS)
2.47% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- Schweitzer Engineering Laboratories, Inc. AcSELerator Architect
Classification
- Weakness
- CWE-611 Improper Restriction of XML External Entity Reference
References
- ics-cert.us-cert.gov /advisories/ICSA-18-191-02 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-10600
- NVD: CVE-2018-10600
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.