Invensys Wonderware InTouch XML External Entities Information Disclosure Vulnerability

Bugtraq ID:	62660
Class:	Input Validation Error
CVE:	CVE-2012-4709
Remote:	Yes
Local:	No
Published:	Sep 20 2013 12:00AM
Updated:	Oct 10 2013 08:23AM
Credit:	Gleb Gritsai, Nikita Mikhalevsky, Timur Yunusov, Denis Baranov, Ilya Karpov, Vyacheslav Egoshin, Dmitry Serebryannikov, Alexey Osipov, Ivan Poliyanchuk, and Evgeny Ermakov of the Positive Technologies Research Team
Vulnerable:
Not Vulnerable:

Invensys Wonderware InTouch XML External Entities Information Disclosure Vulnerability

Invensys Wonderware InTouch is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks. The attacker may also exploit this issue to cause denial-of-service conditions.

Invensys Wonderware InTouch 2012 R2 and prior versions are vulnerable.

Invensys Wonderware InTouch XML External Entities Information Disclosure Vulnerability

An attacker can exploit this issue using readily available tools.

Invensys Wonderware InTouch XML External Entities Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Invensys Wonderware InTouch XML External Entities Information Disclosure Vulnerability

References: