CVE-2018-18659

moderate-risk
Published 2018-10-26

An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-19 Unauthenticated XXE in /management/UdpHttpService issue.

Do I need to act?

-
0.31% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (9)

Udp
Udp
Udp
Udp
Udp
Udp
Udp
Udp
Udp

Affected Vendors

Arcserve

References (7)

Patch https://support.arcserve.com/s/article/360001392563?language=en_US
Patch https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UD...
Third Party Advisory https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/
Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/152033
Patch https://support.arcserve.com/s/article/360001392563?language=en_US
Patch https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UD...
Third Party Advisory https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/
42
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 1/34 · Minimal
Exposure 15/34 · Moderate