PT-2011-1390 · Orbeon · Orbeon Forms

Published 2011-04-27 · Updated 2011-07-19 · CVE-2010-3260

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Orbeon Forms versions prior to 3.9

Description The issue is related to an "XML injection" problem, where the oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component does not properly restrict DTDs in Ajax requests. This allows remote attackers to read arbitrary files or send HTTP requests to intranet servers via an entity declaration in conjunction with an entity reference.

Recommendations For versions prior to 3.9, update to version 3.9 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-3260

Affected Products

Orbeon Forms

References · 5

• 🔥 http://stratsec.net/Research/Advisories/Orbeon-Forms-XML-Entity-Dereferencing-%28SS-2011-004 · Exploit
• https://github.com/orbeon/orbeon-forms/commit/aba6681660f65af7f1676434da68c10298c30200 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2010-3260 · Security Note
• http://wiki.orbeon.com/forms/doc/developer-guide/release-notes/39 · Patch
• http://securityfocus.com/bid/47362 · Note