Description

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T14:17:39.037Z",
  "pubdate": "2026-08-19T14:17:39.037Z",
  "executiveSummary": "Dell OpenManage Enterprise, in versions prior to 4.7.0, is affected by an Improper Restriction of XML External Entity (XXE) Reference vulnerability. This security flaw arises from insecure XML parsing configurations within the application, allowing unauthorized parsing of maliciously crafted XML input containing external entity references.\nThe primary impact of this vulnerability is information exposure, potentially granting unauthorized actors access to sensitive internal files, system configuration data, or internal network resources accessible to the host running the vulnerable application.\nExploitation of this vulnerability requires remote network access to the target system. An attacker must authenticate with low privileges to successfully interact with the vulnerable endpoint and submit the malicious XML payload.\nGiven the ability to extract sensitive data remotely, the risk implications include the potential compromise of confidentiality. Successful exploitation could expose critical infrastructure details, accelerating further attack chains against the affected enterprise environment.\nMitigation requires updating Dell OpenManage Enterprise to version 4.7.0 or later, where the XML external entity resolution flaw is properly addressed and restricted by the vendor.",
  "technicalDetails": "The vulnerability exists within the XML parsing component of Dell OpenManage Enterprise, specifically in versions prior to 4.7.0. The root cause is the improper restriction of XML External Entity (XXE) references during the processing of user-supplied XML data.\nXML parsers that are not explicitly configured to disable external entity resolution will process DOCTYPE declarations containing entity definitions. When an attacker supplies a crafted XML payload defining an external entity pointing to a local file path or an internal URI, the underlying XML parser evaluates the entity during document parsing.\nThe attack flow proceeds as follows: First, an attacker with remote access establishes a network connection to the vulnerable Dell OpenManage Enterprise service. Second, the attacker authenticates using low-privileged credentials to access functionality that accepts XML input. Third, the attacker submits a specially crafted HTTP request or API payload containing malicious XML with inline DTD definitions referencing external resources.\nUpon receiving the input, the vulnerable application passes the data to the insecure XML parser. The parser resolves the external entity, reading the targeted local file or executing a server-side request forgery (SSRF) action depending on the URI scheme provided in the entity definition. Finally, the parser embeds the retrieved data directly into the application response or triggers outbound network traffic, resulting in unauthorized information exposure.\nThe attack prerequisites dictate that the actor must possess remote network access and low-privileged authentication credentials. Network exposure is present wherever the application interfaces accept remote client connections for XML-based data exchange.\nPost-exploitation impact is primarily centered around confidentiality loss. An attacker may leverage the XXE vulnerability to read sensitive configuration files, internal system secrets, or credential stores accessible to the process context, significantly elevating overall organizational risk."
}