CVE-2023-49110 XML External Entity Injection in Kiuwan SAST

When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application either on-premises or cloud/SaaS solution, the transmitted data consists of a ZIP archive containing several files, some of them in the XML file format. During Kiuwan's server-side processing of these XML...

CVE-2023-49110

The Kiuwan SAST web application (on-premises, cloud, or SaaS) is vulnerable to an XML external entity (XXE) injection attack. The flaw exists because the server-side processing of XML files within a ZIP archive uploaded by the Kiuwan Local Analyzer resolves external entities. An attacker with pri...