CVE Feed

    Dashboard / CVE / CVE-2017-13706

    CVE-2017-13706

    XML external entity (XXE) vulnerability in the import package functionality of the deployment module in Lansweeper before 6.0.100.67 allows remote authenticated users to obtain sensitive information, cause a denial of service, conduct server-side request forgery (SSRF) attacks, conduct internal port scans, or have unspecified other impact via an XML request, aka bug #572705.

    Published:Oct 10, 2017
    Last Modified:Apr 20, 2025
    EPS:Oct 10, 2017
    EPSS Score:0.0141
    CVSS Score:9.9

    Affected Products

    Vendor
    Lansweeper
    Product
    Lansweeper

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-221 Data Serialization External Entities Blowup

    Related CVEs

    CVE-2022-32763 (CVSS 6.1) — A cross-site scripting (xss) sanitization vulnerability bypass exists in the SanitizeHtml functionality of Lan…
    CVE-2022-32573 (CVSS 9.9) — A directory traversal vulnerability exists in the AssetActions.aspx addDoc functionality of Lansweeper lanswee…
    CVE-2022-29517 (CVSS 9.9) — A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweepe…
    CVE-2022-29511 (CVSS 6.5) — A directory traversal vulnerability exists in the KnowledgebasePageActions.aspx ImportArticles functionality o…
    CVE-2022-28703 (CVSS 5.4) — A stored cross-site scripting vulnerability exists in the HdConfigActions.aspx altertextlanguages functionalit…
    CVE-2022-27498 (CVSS 6.5) — A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionali…
    CVE-2022-22149 (CVSS 8.8) — A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9…
    CVE-2022-21234 (CVSS 8.8) — An SQL injection vulnerability exists in the EchoAssets.aspx functionality of Lansweeper lansweeper 9.1.20.2. …
    CVE-2022-21210 (CVSS 8.8) — An SQL injection vulnerability exists in the AssetActions.aspx functionality of Lansweeper lansweeper 9.1.20.2…
    CVE-2022-21145 (CVSS 4.8) — A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lans…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High