by Kastro CVE-2024-40896
libxml2 libxml2 — In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even i…
Description · from the CVE record
In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.
Affected
ProductAffectedFixed inSource
libxml22.11.0 – < 2.11.92.11.9CNA
libxml22.12.0 – < 2.12.92.12.9CNA
libxml22.13.0 – < 2.13.32.13.3CNA
Scores by source
CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial