{"id":"CVE-2020-15419","published":"2020-07-28T17:10:18Z","modified":"2024-08-04T13:15:20Z","title":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE…","vendor":"Veeam","product":"ONE","tier":"core","eol":null,"affectedVersions":[{"vendor":"Veeam","product":"ONE","versions":["10.0.0.750_20200415"]}],"description":{"text":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Reporter_ImportLicense class. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. Was ZDI-CAN-10710.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Reporter_ImportLicense class in Veeam ONE (version 10.0.0.750_20200415) improperly restricts XML External Entity references when parsing imported license documents. A remote attacker with no authentication and no user interaction can submit a crafted XML document whose URI the parser resolves and embeds in the output, disclosing arbitrary file contents with SYSTEM privileges.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:17:38Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.59786,"percentile":0.99126,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference"}],"references":[{"url":"https://www.veeam.com/kb3221","tags":["x_refsource_MISC"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-822/","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-7412","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7412","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-07-28","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-15419","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":25.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.83,"detail":"percentile 0.9913"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}