PT-2022-11248 · Mastro · Mastro

Published 2022-06-21 · Updated 2022-06-28 · CVE-2021-40510

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mastro version 1.0

Description The issue allows remote attackers to read system files via custom DTDs, exploiting an XML eXternal Entity (XXE) vulnerability in OBDA systems.

Recommendations For Mastro version 1.0, as a temporary workaround, consider restricting access to custom DTDs until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-40510

Affected Products

Mastro

References · 5

• https://obdasystems.com/mastro · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40510 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40510 · Vendor Advisory
• https://t.me/cibsecurity/44916 · Telegram Post
• https://cyberiskvision.com/advisory · Note