PT-2019-13077 · Mendix · Mendix

Publicado 2019-09-10 · Atualizado 2019-09-11 · CVE-2019-12996

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mendix versions 7.23.5 and earlier

Description The issue in XML import mappings allows DOCTYPE declarations in the XML input that is potentially unsafe. This could lead to unsafe processing of XML data.

Recommendations For Mendix versions 7.23.5 and earlier, consider restricting the use of XML import mappings until a fix is available. As a temporary workaround, avoid using DOCTYPE declarations in XML input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2019-12996

Produtos afetados

Mendix

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-12996 · Aviso do Fabricante
• https://docs.mendix.com/releasenotes/studio-pro/7.23#7236 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12996 · Nota de Segurança