7.8

CVE-2015-3931

Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsec ≫ E-szigno Version <= 3.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.12% 0.795
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-91 XML Injection (aka Blind XPath Injection)

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

http://packetstormsecurity.com/files/132473/Microsec-e-Szigno-Netlock-Mokka-XML-Signature-Wrapping.html
Third Party Advisory
VDB Entry
http://www.neih.gov.hu/?q=node/66
Third Party Advisory
http://www.securityfocus.com/bid/75487
Third Party Advisory
VDB Entry
https://e-szigno.hu/letoltesek/programok-driverek.html
Vendor Advisory
https://www.search-lab.hu/about-us/news/107-37-million-digitally-signed-documents-had-to-be-reverified
Third Party Advisory
https://www.search-lab.hu/eakta
Third Party Advisory