Düşük PoC var
CVE-2013-0340: Libexpat: XML dış varlık (XXE)
Açıklama (NVD)
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
Özet bilgiler
- Ürün
- Libexpat Project Libexpat
- EPSS
- %19,43 (yüzdelik 97)
- CWE
- CWE-611
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| libexpat-project-libexpat | — | — | 2.4.0 |
| python-python | 3.6.0 | — | 3.6.15 |
| python-python | 3.7.0 | — | 3.7.12 |
| python-python | 3.8.0 | — | 3.8.12 |
| python-python | 3.9.0 | — | 3.9.7 |
| apple-ipados | — | — | 14.8 |
| apple-iphone-os | — | — | 14.8 |
| apple-macos | — | — | 11.6 |
| apple-tvos | — | — | 15.0 |
| apple-watchos | — | — | 8.0 |
Kaynaklar
- NVD kaydı
- openwall.com
- seclists.org
- seclists.org
- seclists.org
- seclists.org
- seclists.org
- seclists.org
- seclists.org
- seclists.org
- seclists.org
- securitytracker.com
- www.openwall.com
- www.openwall.com
- www.osvdb.org
- www.securityfocus.com
- github.com
- lists.apache.org
- lists.apache.org
- security.gentoo.org
- support.apple.com
- support.apple.com
- support.apple.com
- support.apple.com
- support.apple.com
- CWE-611