CVE-2021-28973: 
Perforce Helix ALM vulnerability analysis and mitigation

The XML Import functionality in the Administration console of Perforce Helix ALM 2020.3.1 Build 22 contains an XML External Entity (XXE) vulnerability. The vulnerability exists due to insecurely configured software components that parse XML input data, allowing XXE attacks. The vulnerability was discovered on March 7, 2021, and was patched in version 2021.1.0 (Compass Security).

The vulnerability allows an attacker to retrieve sensitive files from the server by submitting specially crafted XML files containing malicious external entity references through the XML Import functionality in the Administration console. When a malicious XML file is uploaded and validated, the content of targeted files on the server can be disclosed through error messages. The vulnerability has been assigned a CVSS v3.1 base score of 4.9 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability can be exploited to read arbitrary files on the server system through XXE attacks. This could lead to the disclosure of sensitive information and configuration files stored on the server (Compass Security).

The vulnerability requires authentication to the Administration console to exploit. A proof-of-concept exploit demonstrates the ability to read the contents of C:\Windows\win.ini file by uploading a specially crafted XML file through the XML Import functionality (Compass Security).

The vulnerability has been fixed in Helix ALM version 2021.1.0. Users should upgrade to this version or later. For systems that cannot be immediately upgraded, the XML parser needs to be hardened by changing configuration settings in the code to disallow the use of inline DTDs and external entities (Compass Security).