CVE-2019-8997 An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567

What is CVE-2019-8997?

CVE-2019-8997 is a medium-severity vulnerability in BlackBerry AtHoc, published on 21 Mar 2019.

Official description

An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an attacker to potentially read arbitrary local files from the application server or make requests on the network by entering maliciously crafted XML in an existing field.

Weakness: CWE-611

Which versions are affected by CVE-2019-8997?

It affects 1 product.

Products include Blackberry Athoc.

How do I fix CVE-2019-8997?

No fix has been published for CVE-2019-8997 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-8997 being exploited?

There is no known exploitation of CVE-2019-8997 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in BlackBerry AtHoc

• CVE-2023-21521 SQL injection in AtHoc High 7.2
• CVE-2023-21522 Cross-site scripting in AtHoc Medium 6.1
• CVE-2023-21523 Cross-site scripting in AtHoc Medium 5.4
• CVE-2023-21520 Information disclosure in AtHoc Medium 5.3
• CVE-2025-12766 Information disclosure in BlackBerry® AtHoc® (OnPrem) Medium 5.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f476-4rjp-2jx3.