CVE-2018-1000124

2018-03-13T21:29:00
ID CVE-2018-1000124
Type cve
Reporter cve@mitre.org
Modified 2018-04-13T14:26:00

Description

I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of importmetadata.php(simplexml_load_string) that can result in an attacker reading the contents of a file and SSRF. This attack appear to be exploitable via posting xml in the Parameter form_import_textarea.