PT-2011-1232 · Perl · Xml::Atom

Florian Weimer · Publicado 2011-06-10 · Atualizado 2021-07-13 · CVE-2012-1102

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XML::Atom versions prior to 0.39

Description The issue is related to the incorrect restriction of XML links to external objects in the XML::Atom Perl module. This allows a remote attacker to gain read access to confidential data by exploiting the vulnerability. The problem arises when the module parses XML from potentially untrusted sources without disabling external entities.

Recommendations For versions prior to 0.39, update to version 0.39 or later to resolve the issue. As a temporary workaround, consider disabling the parsing of XML from untrusted sources until a patch is available. Restrict access to sensitive resources to minimize the risk of exploitation.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2022-02057

CVE-2012-1102

DSA-2424-1

Produtos afetados

Xml::Atom

Referências · 7

• 🔥 https://seclists.org/oss-sec/2012/q1/549 · Exploit
• https://osv.dev/vulnerability/CVE-2012-1102 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2022-02057 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2012-1102 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2012-1102 · Aviso do Fabricante
• https://metacpan.org/release/MIYAGAWA/XML-Atom-0.39/source/Changes · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-1102 · Aviso do Fabricante