Code injection

2011-04-0412:27:00

PRIOn knowledge base

www.prio-n.com

6.8 Medium

AI Score

Confidence

Low

5.1 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.012 Low

EPSS

Percentile

85.1%

JSON

xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification.

CPENameOperatorVersion
xml_security_libraryle1.2.16
xml_security_libraryeq0.0.3
xml_security_libraryeq1.2.10
xml_security_libraryeq0.0.297
xml_security_libraryeq0.0.5
xml_security_libraryeq0.0.9
xml_security_libraryeq1.2.13
xml_security_libraryeq1.2.9
xml_security_libraryeq1.2.14
xml_security_libraryeq1.0.3

Name	Operator	Version
xml_security_library	le	1.2.16
xml_security_library	eq	0.0.3
xml_security_library	eq	1.2.10
xml_security_library	eq	0.0.297
xml_security_library	eq	0.0.5
xml_security_library	eq	0.0.9
xml_security_library	eq	1.2.13
xml_security_library	eq	1.2.9
xml_security_library	eq	1.2.14
xml_security_library	eq	1.0.3