9.8

CVE-2021-43090

Exploit
An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Predic8 ≫ Soa Model Version < 1.6.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.9% 0.769
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

https://github.com/membrane/soa-model/commit/19de16902468e7963cc4dc6b544574bc1ea3f251
Patch
Third Party Advisory
https://github.com/membrane/soa-model/commit/3aa295f155f621d5ea661cb9a0604013fc8fd8ff
Patch
Third Party Advisory
https://github.com/membrane/soa-model/issues/281
Third Party Advisory
Exploit
Issue Tracking
https://github.com/membrane/soa-model/releases/tag/v1.6.4
Third Party Advisory
Release Notes