CVE-2024-6893

Published: Aug 8, 2024Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.

Affected (1)

Products: Journyx: Journyx

Journyx

1 product

Journyx

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Journyx Journyx	Version 11.5.4

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

https://korelogic.com/Resources/Advisories/KL-001-2024-010.txt

Source: bbf0bd87-ece2-41be-b873-96928ee8fab9

ExploitThird Party Advisory

http://seclists.org/fulldisclosure/2024/Aug/8

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.