An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, as demonstrated by a pingback.aspx POST request.
References
| Link | Resource |
|---|---|
| https://github.com/jumpycastle/xmlrpc.net-poc | Exploit Third Party Advisory |
| https://papercutsoftware.github.io/XML-RPC.NET/download.html | Vendor Advisory |
| https://github.com/jumpycastle/xmlrpc.net-poc | Exploit Third Party Advisory |
| https://papercutsoftware.github.io/XML-RPC.NET/download.html | Vendor Advisory |
Configurations
History
21 Nov 2024, 07:32
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/jumpycastle/xmlrpc.net-poc - Exploit, Third Party Advisory | |
| References | () https://papercutsoftware.github.io/XML-RPC.NET/download.html - Vendor Advisory |
22 Dec 2022, 18:14
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:xml-rpc.net_project:xml-rpc.net:*:*:*:*:*:*:*:* | |
| References | (MISC) https://github.com/jumpycastle/xmlrpc.net-poc - Exploit, Third Party Advisory | |
| References | (MISC) https://papercutsoftware.github.io/XML-RPC.NET/download.html - Vendor Advisory | |
| CWE | CWE-611 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
19 Dec 2022, 02:27
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-12-18 04:15
Updated : 2024-11-21 07:32
NVD link : CVE-2022-47514
Mitre link : CVE-2022-47514
CVE.ORG link : CVE-2022-47514
JSON object : View
Products Affected
xml-rpc.net_project
- xml-rpc.net
CWE
CWE-611
Improper Restriction of XML External Entity Reference