CVE-2020-21524

CVE-2020-21524 affects Halo v1.1.3. It is an XML External Entity (XXE) vulnerability in the background XML parsing used by the blog-import feature at /api/admin/migrations/wordpress. The root cause is improper handling of XML that enables intranet discovery, reading files, and potentially enablin...