XML External Entity vulnerability in Easy-XML
Critical severity
GitHub Reviewed
Published
Nov 1, 2021
to the GitHub Advisory Database
•
Updated Sep 20, 2024
Description
Published by the National Vulnerability Database
Oct 31, 2021
Reviewed
Nov 1, 2021
Published to the GitHub Advisory Database
Nov 1, 2021
Last updated
Sep 20, 2024
The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity (XXE) vulnerability which allows for an attacker to expose sensitive data or perform a denial of service (DOS) via a crafted external entity entered into the XML content as input.
References