CVE-2024-13971

Summary

Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobster_pro prior to version 4.12.6-GA. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.

Affected Software

Weaknesses

• CWE-611: CWE-611 Improper Restriction of XML External Entity Reference

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

CVE Program Container

Additional References

• http://seclists.org/fulldisclosure/2026/May/1

References

• https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-005/

• ←Previous
• Next→