Inline DTD allows XML bomb attack · CVE-2019-15160 · GitHub Advisory Database · GitHub

Inline DTD allows XML bomb attack

High severity GitHub Reviewed Published Apr 12, 2022 to the GitHub Advisory Database • Updated Jan 11, 2023

Package

sweet_xml (Erlang)

Affected versions

< 0.7.0

Patched versions

0.7.0

Description

The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD.

References

Published to the GitHub Advisory Database Apr 12, 2022

Reviewed Apr 12, 2022

Last updated Jan 11, 2023

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H