9.1
CVE-2024-40896
- EPSS 1.22%
- Veröffentlicht 23.12.2024 17:15:08
- Zuletzt bearbeitet 25.11.2025 13:32:32
- Erkennungen
LoginIn libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netapp ≫ Hci Compute Node Version -
Netapp ≫ H300s Firmware Version -
Netapp ≫ H410s Firmware Version -
Netapp ≫ H500s Firmware Version -
Netapp ≫ H700s Firmware Version -
Netapp ≫ H410c Firmware Version -
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.22% | 0.652 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| CISA-ADP | 9.1 | 3.9 | 5.2 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
|
CWE-611 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://gitlab.gnome.org/GNOME/libxml2/-/commit/1a8932303969907f6572b1b6aac4081c56adb5c6
https://gitlab.gnome.org/GNOME/libxml2/-/issues/761
https://security.netapp.com/advisory/ntap-20250228-0004/