#VU7320 XXE attack in OSCI-Transport Library - CVE-2017-10670
Published: July 5, 2017
Vulnerability identifier: #VU7320
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-10670
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
OSCI-Transport Library
OSCI-Transport Library
Software vendor:
KoSIT
KoSIT
Description
The vulnerability allows a remote attacker to conduct XXE attack.
The weakness exists in the encryption library due to improper handling of XML External Entity (XXE) entries when parsing an XML file. A remote attacker can send manipulated XML data to any communication partner and read arbitrary files from the file system of the victim host or cause DoS condition.
Successful exploitation of the vulnerability may result in information disclosure or denial of service.
The weakness exists in the encryption library due to improper handling of XML External Entity (XXE) entries when parsing an XML file. A remote attacker can send manipulated XML data to any communication partner and read arbitrary files from the file system of the victim host or cause DoS condition.
Successful exploitation of the vulnerability may result in information disclosure or denial of service.
Remediation
Update to version 1.7.1.