XXE attack in OSCI-Transport Library - CVE-2017-10670
Published: July 5, 2017
Vulnerability identifier: #VU7320
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-10670
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to conduct XXE attack.
The weakness exists in the encryption library due to improper handling of XML External Entity (XXE) entries when parsing an XML file. A remote attacker can send manipulated XML data to any communication partner and read arbitrary files from the file system of the victim host or cause DoS condition.
Successful exploitation of the vulnerability may result in information disclosure or denial of service.
The weakness exists in the encryption library due to improper handling of XML External Entity (XXE) entries when parsing an XML file. A remote attacker can send manipulated XML data to any communication partner and read arbitrary files from the file system of the victim host or cause DoS condition.
Successful exploitation of the vulnerability may result in information disclosure or denial of service.
Affected software
OSCI-Transport Library
How to mitigate CVE-2017-10670
Update to version 1.7.1.