Lucene search

K
githubGitHub Advisory DatabaseGHSA-Q7WX-62R7-J2X7
HistoryAug 08, 2018 - 10:31 p.m.

Nokogiri vulnerable to libxml XML Entity Expansion

2018-08-0822:31:12
CWE-776
GitHub Advisory Database
github.com
20

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.025 Low

EPSS

Percentile

89.9%

The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.

CPENameOperatorVersion
nokogirile1.6.6.3

References

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.025 Low

EPSS

Percentile

89.9%