CVE-2024-46455

Published: Dec 9, 2024Modified: Dec 12, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.

Related CWEs

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

https://binarysouljour.me/cve-2024-46455

Source: cve@mitre.org

https://github.com/Unstructured-IO/unstructured/tree/0.14.2

Source: cve@mitre.org

Timeline

No history available yet.