PT-2011-1390 · Orbeon · Orbeon Forms

Publicado 2011-04-27 · Atualizado 2011-07-19 · CVE-2010-3260

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Orbeon Forms versions prior to 3.9

Description The issue is related to an "XML injection" problem, where the oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component does not properly restrict DTDs in Ajax requests. This allows remote attackers to read arbitrary files or send HTTP requests to intranet servers via an entity declaration in conjunction with an entity reference.

Recommendations For versions prior to 3.9, update to version 3.9 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-3260

Produtos afetados

Orbeon Forms

Referências · 5

• 🔥 http://stratsec.net/Research/Advisories/Orbeon-Forms-XML-Entity-Dereferencing-%28SS-2011-004 · Exploit
• https://github.com/orbeon/orbeon-forms/commit/aba6681660f65af7f1676434da68c10298c30200 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2010-3260 · Nota de Segurança
• http://securityfocus.com/bid/47362 · Nota
• http://wiki.orbeon.com/forms/doc/developer-guide/release-notes/39 · Correção