CVE-2012-1102

It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untrusted sources. This may allow attackers to gain read access to otherwise protected resources, depending on how the library is used.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://metacpan.org/release/MIYAGAWA/XML-Atom-0.39/source/Changes	Release Notes Third Party Advisory
https://seclists.org/oss-sec/2012/q1/549	Exploit Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:xml\:\:atom_project:xml\:\:atom:*:*:*:*:*:perl:*:*

History

No history.

Information

Published : 2021-07-09 11:15

Updated : 2024-02-28 18:28

NVD link : CVE-2012-1102

Mitre link : CVE-2012-1102

CVE.ORG link : CVE-2012-1102

JSON object : View

Products Affected

xml\

\

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2012-1102", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-07-09T11:15:07.407", "references": [{"url": "https://metacpan.org/release/MIYAGAWA/XML-Atom-0.39/source/Changes", "tags": ["Release Notes", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://seclists.org/oss-sec/2012/q1/549", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untrusted sources. This may allow attackers to gain read access to otherwise protected resources, depending on how the library is used."}, {"lang": "es", "value": "Se ha detectado que el m\u00f3dulo XML::Atom Perl versiones anteriores a 0.39, no deshabilitaba las entidades externas cuando analiza XML de fuentes potencialmente no confiables. Esto puede permitir a atacantes conseguir acceso de lectura a recursos que de otro modo estar\u00edan protegidos, dependiendo de c\u00f3mo es usado la biblioteca"}], "lastModified": "2021-07-13T15:21:08.517", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xml\\:\\:atom_project:xml\\:\\:atom:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "E4170090-6DF9-445F-BD39-C923CCCF5183", "versionEndExcluding": "0.39"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}