Design/Logic Flaw

LumisXP aka Lumis Experience Platform before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service...

PT-2021-17676

Name of the Vulnerable Software and Affected Versions: LumisXP aka Lumis Experience Platform versions prior to 10.0.0 Description: The issue allows unauthenticated blind XXE via an API request to "PageControllerXml.jsp". An attacker can send a request crafted with an XXE payload to achieve outcom...