Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running UMS, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Universal Media Server 安全漏洞
Vulnerability Description
Universal Media Server（UMS）是一款媒体服务器，它主要为支持DLNA的设备提供视频、音频和图像查看支持。 UMS 7.1.0版本中用于SSDP/UPnP功能的XML解析引擎存在XML外部实体注入漏洞。远程攻击者可利用该漏洞以运行UMS用户的权限访问文件系统上的文件，启用SMB连接，获取密码或在Windows域中执行命令。
CVSS Information
N/A
Vulnerability Type
N/A