VulnerabilityModified
CVE-2019-8999
An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access to files on any system reachable by the UEM service account.
HIGH 7.5EPSS 1.49%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.49%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access to files on any system reachable by the UEM service account.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.49% probability · 73th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-611
- Affected
- blackberry/unified endpoint management
- Source
- secure@blackberry.com
References
- http://support.blackberry.com/kb/articleDetail?articleNumber=000056241Mitigation, Patch, Vendor Advisory
- http://support.blackberry.com/kb/articleDetail?articleNumber=000056241Mitigation, Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.