CVEvulnerability

CVE-2015-6463

5.8 MEDIUM Published 2015-09-28 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2015-09-28
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 2.0 ([email protected]): 5.8 MEDIUM — AV:A/AC:L/Au:N/C:P/I:P/A:P

Description

CodeWrights HART Comm DTM components, as used with Endress+Hauser FieldCare, allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a longtag XML schema containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected configurations

• codewrights hart comm dtm • endress\+hauser hart comm dtm

References

https://ics-cert.us-cert.gov/advisories/ICSA-15-267-01 Patch, Third Party Advisory, US Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-15-267-01 Patch, Third Party Advisory, US Government Resource