Medium severity4.9NVD Advisory· Published Jan 5, 2020· Updated Jun 17, 2026
CVE-2019-20153
CVE-2019-20153
Description
An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) in v5.4. An XML external entity (XXE) vulnerability in the upload definition feature in definition_upload_attach.jsp allows authenticated remote attackers to read arbitrary files (including configuration files containing administrative credentials).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:determine:contract_lifecycle_management:5.4:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:determine:contract_lifecycle_management:5.4:*:*:*:*:*:*:*
- (no CPE)range: =5.4
- Determine/Contract Lifecycle Management (CLM)description
- Range: =5.4
Patches
Vulnerability mechanics
References
1- www.n00py.io/2020/01/zero-day-exploit-in-determine-selectica-contract-lifecycle-management-sclm-v5-4/nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.