HP WebInspect XXE Unauthorized Information Disclosure

Medium Nessus Plugin ID 84194


A web security application on the remote host is affected by an unauthorized information disclosure vulnerability.


The version of HP WebInspect installed on the remote Windows host is affected by an unauthorized information disclosure vulnerability due to an XML external entity injection flaw that is triggered during the parsing of XML data. A remote attacker can exploit this, via a malicious website scanned by HP WebInspect, to read arbitrary system files.


Upgrade to HP WebInspect version (10.4 Software Update 1) or later.

Note that HP has not yet made this update generally available via SmartUpdate, and you must contact HP Support directly for the fix.

See Also




Plugin Details

Severity: Medium

ID: 84194

File Name: hp_webinspect_SSRT102038.nasl

Version: $Revision: 1.5 $

Type: local

Agent: windows

Family: Windows

Published: 2015/06/15

Modified: 2016/05/20

Dependencies: 84195

Risk Information

Risk Factor: Medium


Base Score: 4.3

Temporal Score: 3.4

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:hp:web_inspect

Required KB Items: installed_sw/HP WebInspect

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2015/06/03

Vulnerability Publication Date: 2015/06/03

Reference Information

CVE: CVE-2015-2125

BID: 75036

OSVDB: 122947

HP: HPSBGN03343, SSRT102038, emr_na-c04695307

EDB-ID: 37250