PT-2019-11538 · Ladon · Ladon

Publicado 2019-07-18 · Atualizado 2019-07-26 · CVE-2019-1010268

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Ladon versions 0.6.1 and later

Description: The issue affects the SOAP request handlers component, allowing for XML External Entity (XXE) attacks. This can lead to information disclosure, enabling attackers to read files and access internal network endpoints. The attack vector involves sending a specially crafted SOAP call.

Recommendations: For versions 0.6.1 and later, consider disabling the SOAP request handlers until a patch is available to prevent exploitation. Restrict access to internal network endpoints to minimize the risk of information disclosure. Avoid using the affected SOAP interface until the issue is resolved.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2019-1010268

GHSA-VG35-VC9F-Q7X2

PYSEC-2019-184

Produtos afetados

Ladon

Referências · 10

• 🔥 https://exploit-db.com/exploits/43113 · Exploit
• https://github.com/pypa/advisory-database/tree/main/vulns/ladon/PYSEC-2019-184.yaml · Nota
• https://bitbucket.org/jakobsg/ladon/pull-requests/9 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010268 · Nota de Segurança
• https://bitbucket.org/jakobsg/ladon/src/42944fc012a3a48214791c120ee5619434505067/src/ladon/interfaces/soap.py#lines-688 · Correção
• https://osv.dev/vulnerability/GHSA-vg35-vc9f-q7x2 · Aviso do Fabricante
• https://github.com/advisories/GHSA-vg35-vc9f-q7x2 · Nota
• https://bitbucket.org/jakobsg/ladon · Nota
• https://osv.dev/vulnerability/PYSEC-2019-184 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1010268 · Aviso do Fabricante