#VU7320 XXE attack in OSCI-Transport Library

Published: 2017-07-05

Vulnerability identifier: #VU7320

Vulnerability risk: Low


CVE-ID: CVE-2017-10670


Exploitation vector: Network

Exploit availability: No

Vulnerable software:
OSCI-Transport Library
Universal components / Libraries / Libraries used by multiple products

Vendor: KoSIT

The vulnerability allows a remote attacker to conduct XXE attack.

The weakness exists in the encryption library due to improper handling of XML External Entity (XXE) entries when parsing an XML file. A remote attacker can send manipulated XML data to any communication partner and read arbitrary files from the file system of the victim host or cause DoS condition.

Successful exploitation of the vulnerability may result in information disclosure or denial of service.

Update to version 1.7.1.

Vulnerable software versions

OSCI-Transport Library: 1.6.1


External links

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

Latest bulletins with this vulnerability