PT-2022-11249 · Mastro · Mastro

Published 2022-06-21 · Updated 2022-06-28 · CVE-2021-40511

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mastro version 1.0

Description The issue allows for a denial of service through an XML Entity Expansion attack, also known as a "billion laughs" attack.

Recommendations For Mastro version 1.0, consider disabling XML Entity Expansion to prevent the denial of service attack until a patch is available. Restrict access to the XML parsing module to minimize the risk of exploitation. Avoid using vulnerable XML features in the affected system until the issue is resolved.

Fix

XML Entity Expansion

Weakness Enumeration

CWE-776

Related Identifiers

CVE-2021-40511

Affected Products

Mastro

References · 5

• https://obdasystems.com/mastro · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40511 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40511 · Vendor Advisory
• https://cyberiskvision.com/advisory · Note
• https://t.me/cibsecurity/44914 · Telegram Post