An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker can send a request crafted with an XXE payload to invoke a malicious DTD hosted on a system that they control. This results in reading local files that the application has access to.
References
| Link | Resource |
|---|---|
| https://docs.morpheusdata.com/en/5.4.4/release_notes/current.html | Release Notes Vendor Advisory |
| https://support.morpheusdata.com/s/?language=en_US | Not Applicable Vendor Advisory |
| https://docs.morpheusdata.com/en/5.4.4/release_notes/current.html | Release Notes Vendor Advisory |
| https://support.morpheusdata.com/s/?language=en_US | Not Applicable Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:04
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://docs.morpheusdata.com/en/5.4.4/release_notes/current.html - Release Notes, Vendor Advisory | |
| References | () https://support.morpheusdata.com/s/?language=en_US - Not Applicable, Vendor Advisory |
Information
Published : 2022-05-24 15:15
Updated : 2024-11-21 07:04
NVD link : CVE-2022-31261
Mitre link : CVE-2022-31261
CVE.ORG link : CVE-2022-31261
JSON object : View
Products Affected
morpheusdata
- morpheus
CWE
CWE-611
Improper Restriction of XML External Entity Reference