A vulnerability was found in Micro Focus Arcsight Logger up to 6.6 (Log Management Software). It has been classified as critical. Affected is an unknown part of the component XML Data Handler. The manipulation with an unknown input leads to a xml external entity reference vulnerability. CWE is classifying the issue as CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7.

The bug was discovered 03/11/2019. The weakness was presented 03/25/2019. This vulnerability is traded as CVE-2019-3481 since 12/31/2018. The exploitability is told to be easy. It is possible to launch the attack remotely. A authentication is necessary for exploitation. The technical details are unknown and an exploit is not available.

The vulnerability was handled as a non-public zero-day exploit for at least 14 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 6.7 eliminates this vulnerability.

See VDB-132201, VDB-132200, VDB-132199 and VDB-132197 for similar entries.

Productinfo

Type

• Log Management Software

Vendor

• Micro Focus

Name

• Arcsight Logger

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion