Lucene search

Veracode Vulnerability DatabaseVERACODE:47481

HistoryJun 12, 2024 - 5:47 a.m.

XML Entity Expansion (XXE)

2024-06-1205:47:47

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

xml entity expansion

xxe

vulnerability

xml input

crafted xml

sensitive information

denial of service

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

ebookmeta is vulnerable to an XML External Entity (XXE) vulnerability. The vulnerability is due to improper handling of crafted XML input in the ebookmeta.get_metadata function, allowing attackers to access sensitive information or cause a Denial of Service (DoS).

CPENameOperatorVersion
ebookmetale1.2.11
ebookmetale1.2.11

CPE	Name	Operator	Version
	ebookmeta	le	1.2.11
	ebookmeta	le	1.2.11

References

github.com/advisories/GHSA-whf4-fpj8-pgg8

github.com/dnkorpushov/ebookmeta/issues/16#issue-2317712335