PT-2020-15629 · Moog · Moog Exo Series

Gabriel Gonzalez + 3 · Published 2020-08-21 · Updated 2021-07-21 · CVE-2020-24052

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Moog EXO Series versions EXVF5C-2 and EXVP7C2-3

Description The issue concerns several XML External Entity (XXE) vulnerabilities. These vulnerabilities allow remote unauthenticated users to read arbitrary files by using a crafted Document Type Definition (DTD) in an XML request.

Recommendations For Moog EXO Series versions EXVF5C-2 and EXVP7C2-3, consider disabling the XML parsing functionality until a patch is available. Restrict access to the XML request handling module to minimize the risk of exploitation. Avoid using crafted DTDs in XML requests until the issue is resolved.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-24052

Affected Products

Moog Exo Series

References · 3

• 🔥 https://ioac.tv/3hy1xu6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-24052 · Security Note
• https://ioactive.com/moog-exo-series-multiple-vulnerabilities · Note