PT-2024-34534 · Unknown · Powertac-Server

Jacklosingheart · Published 2024-11-08 · Updated 2024-11-12 · CVE-2024-51135

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: powertac-server version 1.9.0

Description: An XML External Entity (XXE) vulnerability in the component DocumentBuilderFactory allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.

Recommendations: For powertac-server version 1.9.0, consider disabling the DocumentBuilderFactory component until a patch is available to prevent exploitation of the XXE vulnerability. Restrict access to sensitive information and limit the execution of arbitrary code by implementing additional security measures, such as input validation and sanitization of XML entities.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-51135

GHSA-PGRC-8WP5-5MVQ

Affected Products

Powertac-Server

References · 11

• https://osv.dev/vulnerability/CVE-2024-51135 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51135 · Security Note
• https://osv.dev/vulnerability/GHSA-pgrc-8wp5-5mvq · Vendor Advisory
• https://github.com/powertac/powertac-server · Note
• https://github.com/powertac/powertac-server/issues/1166 · Note
• https://t.me/cvedetector/10518 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1855105662721601552 · Twitter Post
• https://twitter.com/CVEnew/status/1856052502447235159 · Twitter Post
• https://t.me/cvenotify/101304 · Telegram Post
• https://mvnrepository.com/artifact/org.powertac/server-interface · Note
• http://powertac.org · Note