TI-2020-13174 Aliases CVE-2020-17408 GHSA-4ffh-54c8-m8qq

XML external entity injection in NEC Corporation ExpressCluster

HIGH 71CWE-611Published 2020-09-10 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-611 and the CVSS impact.

Summary

This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the clpwebmc executable. Due to the improper restriction of XML External Entity (XXE) references, a specially-crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-10801.

Why it matters now

EPSS 0.71338 99th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NEC Corporation	ExpressCluster	4.1	—	No fix listed	CNA

ExpressCluster VendorNEC Corporation Affected 4.1 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:nec:expresscluster_x:4.1:::::windows::	4.1	Vulnerable	NEC Corporation
cpe:2.3:a:nec:expresscluster_x:4.2:::::windows::	4.2	Vulnerable	NEC Corporation

cpe:2.3:a:nec:expresscluster_x:4.1:*:*:*:*:windows:*:* Versions 4.1 Vulnerable ·NEC Corporation
cpe:2.3:a:nec:expresscluster_x:4.2:*:*:*:*:windows:*:* Versions 4.2 Vulnerable ·NEC Corporation

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-17408
2026-10-03 Alias added: GHSA-4ffh-54c8-m8qq

References

Patch 1

https://www.support.nec.co.jp/en/View.aspx?id=9510100319

Advisory 1

https://www.zerodayinitiative.com/advisories/ZDI-20-1102/

TI-2022-15632 Uncontrolled search path in NEC Corporation CLUSTERPRO X CVSS 3.1CRITICAL 9.8
TI-2022-15631 Incorrect default permissions in NEC Corporation CLUSTERPRO X CVSS 3.1CRITICAL 9.8
TI-2022-15630 Buffer overflow in NEC Corporation CLUSTERPRO X CVSS 3.1CRITICAL 9.8
TI-2022-15629 Path traversal in NEC Corporation CLUSTERPRO X CVSS 3.1CRITICAL 9.8
TI-2021-03930 Buffer overflow in NEC Corporation CLUSTERPRO X CVSS 3.1CRITICAL 9.8
TI-2021-03929 Buffer overflow in NEC Corporation CLUSTERPRO X CVSS 3.1CRITICAL 9.8

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences