XML External Entities (XXE)

2018-08-0602:11:43

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

JSON

libxml2 is vulnerable to XML external entity attacks. The xmlParserHandlePEReference function in parser.c allows external parameter entities to be loaded regardless of whether entity substitution or validation is enabled. This allows an attacker to cause a denial of service condition or an information leak using a crafted XML document.

CPENameOperatorVersion
libxml2.sole2.9.1
libxml2eq2.7.6__1.el6
libxml2eq2.7.6__4.el6
libxml2eq2.7.6__8.el6_3.3
libxml2eq2.7.6__4.el6_2.1
libxml2eq2.7.6__12.el6_4.1
libxml2eq2.7.6__8.el6_3.4
libxml2eq2.7.6__4.el6_2.4
libxml2.sole2.9.1
libxml2eq2.7.6__1.el6

Name	Operator	Version
libxml2.so	le	2.9.1
libxml2	eq	2.7.6__1.el6
libxml2	eq	2.7.6__4.el6
libxml2	eq	2.7.6__8.el6_3.3
libxml2	eq	2.7.6__4.el6_2.1
libxml2	eq	2.7.6__12.el6_4.1
libxml2	eq	2.7.6__8.el6_3.4
libxml2	eq	2.7.6__4.el6_2.4
libxml2.so	le	2.9.1
libxml2	eq	2.7.6__1.el6