Vulnerability identifier: #VU7320
Vulnerability risk: Low
Exploitation vector: Network
Exploit availability: No
The vulnerability allows a remote attacker to conduct XXE attack.
The weakness exists in the encryption library due to improper handling of XML External Entity (XXE) entries when parsing an XML file. A remote attacker can send manipulated XML data to any communication partner and read arbitrary files from the file system of the victim host or cause DoS condition.
Successful exploitation of the vulnerability may result in information disclosure or denial of service.
Update to version 1.7.1.
Vulnerable software versions
OSCI-Transport Library: 1.6.1
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.