5

CVE-2009-5135

Exploit
The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files via a request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nextapp ≫ Echo Updaterc5 Version <= 2.1.0
Nextapp ≫ Echo Version2.0 Updatealpha1
Nextapp ≫ Echo Version2.0 Updatealpha10
Nextapp ≫ Echo Version2.0 Updatealpha11
Nextapp ≫ Echo Version2.0 Updatealpha12
Nextapp ≫ Echo Version2.0 Updatealpha13
Nextapp ≫ Echo Version2.0 Updatealpha14
Nextapp ≫ Echo Version2.0 Updatealpha15
Nextapp ≫ Echo Version2.0 Updatealpha16
Nextapp ≫ Echo Version2.0 Updatealpha2
Nextapp ≫ Echo Version2.0 Updatealpha3
Nextapp ≫ Echo Version2.0 Updatealpha4
Nextapp ≫ Echo Version2.0 Updatealpha5
Nextapp ≫ Echo Version2.0 Updatealpha6
Nextapp ≫ Echo Version2.0 Updatealpha7
Nextapp ≫ Echo Version2.0 Updatealpha8
Nextapp ≫ Echo Version2.0 Updatealpha9
Nextapp ≫ Echo Version2.0 Updatebeta1
Nextapp ≫ Echo Version2.0 Updatebeta2
Nextapp ≫ Echo Version2.0 Updatebeta3
Nextapp ≫ Echo Version2.0 Updatebeta4
Nextapp ≫ Echo Version2.0 Updaterc1
Nextapp ≫ Echo Version2.0 Updaterc2
Nextapp ≫ Echo Version2.0 Updaterc3
Nextapp ≫ Echo Version2.0 Updaterc4
Nextapp ≫ Echo Version2.0 Updaterc5
Nextapp ≫ Echo Version2.0 Updaterc6
Nextapp ≫ Echo Version2.0 Updaterc7
Nextapp ≫ Echo Version2.0.1 Updatetest1
Nextapp ≫ Echo Version2.0.1 Updatetest2
Nextapp ≫ Echo Version2.0.1 Updatetest3
Nextapp ≫ Echo Version2.1.0 Updatebeta1
Nextapp ≫ Echo Version2.1.0 Updatebeta2
Nextapp ≫ Echo Version2.1.0 Updatebeta3
Nextapp ≫ Echo Version2.1.0 Updatebeta4
Nextapp ≫ Echo Version2.1.0 Updatebeta5
Nextapp ≫ Echo Version2.1.0 Updaterc1
Nextapp ≫ Echo Version2.1.0 Updaterc2
Nextapp ≫ Echo Version2.1.0 Updaterc3
Nextapp ≫ Echo Version2.1.0 Updaterc4
Nextapp ≫ Echo Version3.0 Updatebeta1
Nextapp ≫ Echo Version3.0 Updatebeta2
Nextapp ≫ Echo Version3.0 Updatebeta3
Nextapp ≫ Echo Version3.0 Updatebeta4
Nextapp ≫ Echo Version3.0 Updatebeta5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 9.92% 0.95
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://echo.nextapp.com/site/node/5742
Vendor Advisory
http://secunia.com/advisories/34218
Vendor Advisory
http://www.exploit-db.com/exploits/8191/
Exploit
http://www.securityfocus.com/archive/1/501637/100/0/threaded
http://www.vupen.com/english/advisories/2009/0653
https://exchange.xforce.ibmcloud.com/vulnerabilities/49167
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20090305-0_echo_nextapp_xml_injection.txt
Exploit