Database/Control plane, storage & DevOps
Schneider Electric Data Center Expert - SOAP service endpoints: XML external entity processing on DCE SOAP endpoints
Impact
XML external entity processing on DCE SOAP endpoints lets an authenticated user read server-side files. On a DCIM appliance that means configuration and credential material for the power and cooling estate - the recurring theme with DCE is that any read primitive is a facility-wide credential leak.
Who can reach it
Any user with a DCE account submitting crafted XML to the SOAP endpoints.
What to do
Apply the Schneider fix for DCE. Audit DCE account holders in the same pass. Cheap software update; the credential rotation afterwards is the expensive half.
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.