CVE-2016-9487CWE-611

EpubCheck 4.0.1 is vulnerable to external XML entity processing attacks

published July 13, 2018

CVSS
—
EPSS
1%
Percentile
69.3
In the wild
Unconfirmed
What it is

EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf, abusing the victim's trust relationship with other entities.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01262 · 69.3th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2018-07-13T20:00Z
EPSS history
Timeline
  • 13 JUL 20:00Z
    EpubCheck 4.0.1 is vulnerable to external XML entity processing attacks
    cvelistv5