Executive Summary

This vulnerability occurs because the component accepts XML input through the publisher without disabling external entity resolution. This means that an attacker can submit a specially crafted XML payload that includes external entity references which are not properly escaped or blocked.

By exploiting this, the attacker can cause the system to process these external entities, potentially allowing them to read confidential files from the product's file system or access restricted HTTP resources via HTTP GET requests.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that a malicious actor could gain unauthorized access to sensitive information stored on the system by reading confidential files.

Additionally, the attacker could access limited HTTP resources that should not be reachable, potentially exposing further sensitive data or internal services.

The CVSS score indicates a low to medium severity with limited impact on confidentiality and no impact on integrity or availability, but it still represents a risk of information disclosure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a malicious actor to read confidential files from the product's file system or access limited HTTP resources. Such unauthorized access to confidential information can lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls to protect sensitive data from unauthorized disclosure.

By exploiting this vulnerability, the confidentiality of sensitive data may be compromised, potentially resulting in non-compliance with standards that mandate data privacy and security.

Useful 0 Not Useful 0