PT-2026-99793 · Apache · Apache Roller
CVSS v3.1
7.7
عالية
| المتجه | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Roller version 6.1.5
Description
Improper restriction of XML External Entity (XXE) references allows a weblog administrator to read files accessible by the Roller process and access internal network addresses. This occurs when importing a crafted OPML document because the bookmark import parser fails to disable external entity resolution. The issue is accessible via the administrator bookmark-import action and requires no non-default configuration.
Recommendations
Upgrade Apache Roller to version 6.1.6 or later.
استغلال
إصلاح
XXE
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Apache Roller