← Back

CVE-2023-49967

nvd nist
Published: Dec 7, 2023Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc.

Affected (3)

Products: Typecho: Typecho
Typecho
1 product
Typecho
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Typecho
Typecho
Version 1.2.1
Typecho
Version 1.2.1 rc2
Typecho
Version 1.2.1 rc

Related CWEs

CWE-776
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References (2)

Source: cve@mitre.org
ExploitIssue TrackingThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.