CVE-2024-7098

Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection.This issue affects ww.Winsure: before 4.6.2.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.usom.gov.tr/bildirim/tr-24-1475	Broken Link Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sfs:winsure:*:*:*:*:*:*:*:*

History

20 Sep 2024, 17:14

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
References	~~() https://www.usom.gov.tr/bildirim/tr-24-1475 -~~	() https://www.usom.gov.tr/bildirim/tr-24-1475 - Broken Link, Third Party Advisory
First Time		Sfs Sfs winsure
Summary		(es) La vulnerabilidad de restricción incorrecta de referencia de entidad externa XML en SFS Consulting ww.Winsure permite la inyección XML. Este problema afecta a ww.Winsure: antes de 4.6.2.
CPE		cpe:2.3:a:sfs:winsure::::::::

16 Sep 2024, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-16 15:15

Updated : 2024-09-20 17:14

NVD link : CVE-2024-7098

Mitre link : CVE-2024-7098

CVE.ORG link : CVE-2024-7098

JSON object : View

Products Affected

sfs

winsure

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2024-7098", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "iletisim@usom.gov.tr", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 9.2, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "NONE", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "LOW", "subsequentSystemConfidentiality": "HIGH", "vulnerableSystemConfidentiality": "HIGH", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-09-16T15:15:17.223", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-24-1475", "tags": ["Broken Link", "Third Party Advisory"], "source": "iletisim@usom.gov.tr"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "iletisim@usom.gov.tr", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection.This issue affects ww.Winsure: before 4.6.2."}, {"lang": "es", "value": "La vulnerabilidad de restricci\u00f3n incorrecta de referencia de entidad externa XML en SFS Consulting ww.Winsure permite la inyecci\u00f3n XML. Este problema afecta a ww.Winsure: antes de 4.6.2."}], "lastModified": "2024-09-20T17:14:53.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sfs:winsure:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FDA3D2E1-4829-46AF-9024-D9CCC53ACF4F", "versionEndExcluding": "4.6.2"}], "operator": "OR"}]}], "sourceIdentifier": "iletisim@usom.gov.tr"}