CVE-2018-16252 XML external entity in n/a
An attacker can exploit XML External Entity injection in Event Log Explorer via malicious .elx files to read sensitive data or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-16252?
CVE-2018-16252 is a low-severity vulnerability in n/a, published on 5 Sep 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection.
Weakness: CWE-611
Which versions are affected by CVE-2018-16252?
It affects 1 product.
Products include Fspro Event Log Explorer.
How do I fix CVE-2018-16252?
No fix has been published for CVE-2018-16252 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-16252 being exploited?
There is no known exploitation of CVE-2018-16252 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-g939-wpmq-66q4.