PT-2019-12351 · Nopcommerce · Nopcommerce

Andreimaz · Published 2019-04-25 · Updated 2019-05-01 · CVE-2019-11519

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions nopCommerce versions prior to 4.10

Description The issue concerns an XXE vulnerability in the LocalizationService.cs file. This vulnerability can be exploited via the "Configurations -> Languages -> Edit Language -> Import Resources -> Upload XML file" screen, allowing for potential XML eXternal Entity (XXE) attacks.

Recommendations For versions prior to 4.10, as a temporary workaround, consider disabling the XML file upload functionality in the "Configurations -> Languages -> Edit Language -> Import Resources" section until a patch is available. Restrict access to the LocalizationService.cs file to minimize the risk of exploitation. Avoid using the XML upload feature in the affected screen until the issue is resolved.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2019-11519

Affected Products

Nopcommerce

References · 4

• 🔥 https://nopcommerce.com/boards/t/62390/xxe-version-390.aspx · Exploit
• https://github.com/nopSolutions/nopCommerce/issues/3713 · Patch
• https://osv.dev/vulnerability/CVE-2019-11519 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11519 · Security Note