CVE

Id
45844  
CVE No.
CVE-2010-3260  
Status
Candidate  
Description
oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component in the XForms service in Orbeon Forms before 3.9 does not properly restrict DTDs in Ajax requests, which allows remote attackers to read arbitrary files or send HTTP requests to intranet servers via an entity declaration in conjunction with an entity reference, related to an "XML injection" issue.  
Phase
Assigned (20100907)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
498920 45844 CVE-2010-3260 MISC:http://www.stratsec.net/Research/Advisories/Orbeon-Forms-XML-Entity-Dereferencing-%28SS-2011-004  View
498921 45844 CVE-2010-3260 CONFIRM:http://wiki.orbeon.com/forms/doc/developer-guide/release-notes/39  View
498922 45844 CVE-2010-3260 CONFIRM:https://github.com/orbeon/orbeon-forms/commit/aba6681660f65af7f1676434da68c10298c30200  View
498923 45844 CVE-2010-3260 BID:47362  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
37253 JVNDB-2010-003038 Novell Identity Manager のエンジンインストーラにおける重要な情報を取得される脆弱性 Novell Identity Manager のエンジンインストーラは、/tmp/idmInstall.log に 管理者ツリーの資格情報を格納するため、重要な情報を取得される脆弱性が存在します。 CVE-2010-3264 45844 2.1 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-003038.html  View