CVE-2026-109430
CVE-2026-109430 · Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.
CVSS 8.7 · Alta · EPSS 0,3%
- Publicación
- Actualización
Productos y versiones afectados
webadvisor
- Versiones
- 3.2: Afectada (custom)
Sin corrección publicada