CVE-2016-6798

{"id": "CVE-2016-6798", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2017-07-19T15:29:00.213", "references": [{"url": "http://www.securityfocus.com/bid/99873", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/b72c3a511592ec70729b3ec2d29302b6ce87bbeab62d4745617a6bd0%40%3Cdev.sling.apache.org%3E", "source": "security@apache.org"}, {"url": "http://www.securityfocus.com/bid/99873", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.apache.org/thread.html/b72c3a511592ec70729b3ec2d29302b6ce87bbeab62d4745617a6bd0%40%3Cdev.sling.apache.org%3E", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on the filesystem, perform same-site-request-forgery (SSRF), port-scanning behind the firewall or DoS the application."}, {"lang": "es", "value": "En el m\u00f3dulo de la API de protecci\u00f3n XSS anterior a la versi\u00f3n 1.0.12 en Apache Sling, el m\u00e9todo XSS.getValidXML() utiliza un analizador SAX no seguro para comprobar la cadena de entrada, lo que permite ataques de tipo XXE en todos los scripts que utilizan este m\u00e9todo para comprobar la entrada del usuario, potencialmente permitiendo a un atacante leer datos confidenciales en el sistema de archivos, realizar ataques de tipo same-site-request-forgery (SSRF), escanear puertos detr\u00e1s del firewall o realizar una DoS de la aplicaci\u00f3n."}], "lastModified": "2024-11-21T02:56:50.940", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:sling:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2A62F4D-F969-446E-8A2B-BD817101880F", "versionEndIncluding": "1.0.10"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}