PT-2024-27172 · Ebookmeta · Ebookmeta
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
ebookmeta versions prior to 1.2.8
Description
An XML External Entity (XXE) vulnerability in the
ebookmeta.get metadata function allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.Recommendations
For versions prior to 1.2.8, update to version 1.2.8 or later to resolve the issue.
As a temporary workaround, consider disabling the
ebookmeta.get metadata function until a patch is available.Exploit
Fix
XML Entity Expansion
XXE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ebookmeta