CVE-2010-3260

oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component in the XForms service in Orbeon Forms before 3.9 does not properly restrict DTDs in Ajax requests, which allows remote attackers to read arbitrary files or send HTTP requests to intranet servers via an entity declaratio...

CVE-2010-3260

oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component in the XForms service in Orbeon Forms before 3.9 does not properly restrict DTDs in Ajax requests, which allows remote attackers to read arbitrary files or send HTTP requests to intranet servers via an entity declaratio...

CVE-2010-3260

CVE-2010-3260 affects Orbeon Forms (xforms-server) prior to version 3.9, where oxf/xml/xerces/XercesSAXParserFactoryImpl.java does not properly restrict DTDs in AJAX requests. This XML injection flaw allows remote attackers to read arbitrary files or trigger requests to intranet servers via an en...