PT-2016-3316 · Perl+1 · Xml::Twig+1
Publicado
2016-09-27
·
Atualizado
2024-06-15
·
CVE-2016-9180
CVSS v2.0
9.4
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
perl-XML-Twig (affected versions not specified)
Description
The issue is related to the
expand external ents option in XML::Twig, which is supposed to control external entity expansion in XML documents but does not work as intended. As a result, external entities are always expanded, regardless of the option's setting. This can be exploited by a remote attacker using a specially crafted XML message, potentially leading to a denial of service or unauthorized access to protected information.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
XXE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Suse
Xml::Twig