PT-2019-4509 · Easy Xml Editor · Easy Xml Editor

Javier Olmedo · Published 2019-11-30 · Updated 2022-01-01 · CVE-2019-19031

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Easy XML Editor versions prior to 1.7.9

Description The issue is related to XML External Entity Injection in the XML Parsing component, allowing for Arbitrary File Read and Denial of Service (DoS) by consuming resources. This can be achieved through a specially crafted XML payload. The attack vector involves exploiting errors in XML request processing, potentially enabling a remote attacker to cause application downtime or read arbitrary files in the system by tricking a user into opening a specially formed XML file.

Recommendations For Easy XML Editor versions prior to 1.7.9, update to version 1.7.9 or later to resolve the issue. As a temporary workaround, consider restricting the use of the XML Parsing component until a patch is available. Avoid using specially crafted XML payloads in the affected XML Parsing component to minimize the risk of exploitation.

Exploit

Fix

XXE

Weakness Enumeration

CWE-91

CWE-611

Related Identifiers

BDU:2020-00402

CVE-2019-19031

Affected Products

Easy Xml Editor

References · 7

• 🔥 https://exploit-db.com/exploits/47945 · Exploit
• 🔥 https://hackpuntes.com/cve-2019-19031-easy-xml-editor-1-7-8-inyeccion-xml · Exploit
• 🔥 http://packetstormsecurity.com/files/155996/Easy-XML-Editor-1.7.8-XML-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-19031 · Security Note
• https://bdu.fstec.ru/vul/2020-00402 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19031 · Vendor Advisory
• https://packetstormsecurity.com/files/155996/Easy-XML-Editor-1.7.8-XML-Injection.html · Note