BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality.

published 2019-12-04 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-2917

cvss: 6.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.8%; EPSS 1.8% chance of exploitation in 30 days, percentile 79%
public exploits: 0; none known

BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to download local files from the server, or do DoS attacks with XML expansion attacks. XXE with direct response and XXE OOB are allowed.

Exploit prediction

1.84% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

seclists.org http://seclists.org/fulldisclosure/2019/Dec/7 referenced PoC, tagged "exploit" by a source, unverified
packetstormsecurity.com http://packetstormsecurity.com/files/155552/BMC-Smart-Reporting-7.3-20180418-XML-Injection.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
NVD	2.0	5.5	AV:N/AC:L/Au:S/C:P/I:N/A:P

Classification

Weakness

CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-611 Improper Restriction of XML External Entity Reference

References

seclists.org /fulldisclosure/2019/Dec/7
exploit, mailing-list, third-party-advisory
packetstormsecurity.com /files/155552/BMC-Smart-Reporting-7.3-20180418-XML-Injection.html
exploit, third-party-advisory, vdb-entry
docs.bmc.com /docs/itsm90/export-and-import-repository-509983929.html
product

Sources

CVE List CVE-2019-11216
NVD CVE-2019-11216

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary