CVE-2018-12463: MFSBGN03811 rev.1 - Fortify Software Security Center (SSC), Multiple vulnerabilities

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-07-12 · updated 2026-06-17
Weakness: CWE-611

Description

An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.

Affected products

Micro Focus Fortify Software Security Center: 17.1, 17.2, 18.1

References

http://www.securitytracker.com/id/1041286
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03201563
https://www.exploit-db.com/exploits/45027/
http://www.securitytracker.com/id/1041286
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03201563
https://www.exploit-db.com/exploits/45027/

Get alerted when CVE-2018-12463 or the next vulnerability affects your stack