The vulnerability in Ellucian WebAdvisor 3.2 is an unauthenticated XML External Entity (XXE) injection flaw that allows remote attackers to send crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint. Because the application does not disable external entity processing or DTD resolution, an attacker can force the server to issue Server‑Side Request Forgery calls, coerce the disclosure of NTLMv2 hashes via attacker‑controlled SMB shares, and read arbitrary files from the underlying Windows host through an out‑of‑band error‑based channel. These capabilities result in remote data exfiltration, potential code execution, and privilege escalation on the compromised server.

The affected product is Ellucian WebAdvisor 3.2, which entered end‑of‑support status in June 2022. Users of this version run a Windows host exposing the /WebAdvisor/WebAdvisor endpoint. No other product versions are listed as vulnerable, so the problem is specific to the 3.2 release.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, leaving the likelihood of exploitation uncertain, but the unauthenticated nature of the flaw and its ability to perform SSRF and file reads present a compelling attack surface. The vulnerability is not listed in the CISA KEV catalog. Attackers likely need only network connectivity to the application endpoint, and because authentication is not required, any host inside or outside the network can target the flaw.