XXE Vulnerability in Cosminexus Component Container
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 11-70-03, 11-60-03, 11-20-10, 11-00-13, 09-87-10, and 2 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Hitachi Cosminexus Component Container
From 11-70-01 · fixed in 11-70-03; From 11-60 · fixed in 11-60-03; From 11-50 · through 11-50-03; From 11-40 · through 11-40-03; From 11-30 · through 11-30-08; From 11-20 · fixed in 11-20-10; From 11-10 · through 11-10-11; From 11-00 · fixed in 11-00-13; From 09-87 · fixed in 09-87-10; From 09-80 · fixed in 09-80-05; From 09-70 · fixed in 09-70-28; From 09-50 · through 09-50-22; From 09-00 · through 09-00-18