CVE-2024-6893 Journyx Unauthenticated XML External Entities Injection

2024-08-0723:22:08

CWE-611

KoreLogic

github.com

journyx

xml external entities

unauthenticated

file reading

ssrf

server resource overwhelm

AI Score

Confidence

High

EPSS

0.941

Percentile

99.2%

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

The “soap_cgi.pyc” API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:journyx:journyx:11.5.4:*:*:*:*:*:*:*"
    ],
    "vendor": "journyx",
    "product": "journyx",
    "versions": [
      {
        "status": "affected",
        "version": "11.5.4"
      }
    ],
    "defaultStatus": "unknown"
  }
]