« Volver al listado

CVE-2018-15362

Estado: ModificadaCrítica (9.1)—

XXE in GE Proficy Cimplicity GDS versions 9.0 R2, 9.5, 10.0

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

GE — Cimplicity

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-15362",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vulnerability@kaspersky.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "GE Proficy Cimplicity GDS",
          "versions": [
            {
              "status": "affected",
              "version": "9.0 R2, 9.5, 10.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-12-07T15:29:00.487",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/106133",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "vulnerability@kaspersky.com"
    },
    {
      "url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/07/klcert-18-025-general-electric-proficy-gds-xml-external-entity-xxe/",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "vulnerability@kaspersky.com"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-340-01",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "vulnerability@kaspersky.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/106133",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/07/klcert-18-025-general-electric-proficy-gds-xml-external-entity-xxe/",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-340-01",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XXE in GE Proficy Cimplicity GDS versions 9.0 R2, 9.5, 10.0"
    },
    {
      "lang": "es",
      "value": "XEE (XML External Entity) en GE Proficy Cimplicity GDS en versiones 9.0 R2, 9.5 y 10.0."
    }
  ],
  "lastModified": "2026-06-17T01:42:19.117",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ge:cimplicity:9.0_r2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "097CC9BA-1B2A-4E8B-9551-35C013F508AA"
            },
            {
              "criteria": "cpe:2.3:a:ge:cimplicity:9.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4EF8280-D696-4E0F-A695-DC47E4857166"
            },
            {
              "criteria": "cpe:2.3:a:ge:cimplicity:10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C14018E5-4570-4422-A3DE-6F66C3AD28E5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vulnerability@kaspersky.com"
}