CVE-2019-9757

Published: Oct 29, 2019Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read.

Affected (1)

Products: Labkey: Labkey Server

Labkey

1 product

Labkey Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Labkey Labkey Server	Version 19.1.0

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (4)

https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2019-9757

Source: cve@mitre.org

Exploit

https://rhinosecuritylabs.com/application-security/labkey-server-vulnerabilities-to-rce

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2019-9757

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://rhinosecuritylabs.com/application-security/labkey-server-vulnerabilities-to-rce

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.