CVE-2018-19858

PrinceXML, versions 10 and below, is vulnerable to XXE due to the lack of protection against external entities

published January 29, 2019

CVSS
—
EPSS
3%
Percentile
85.2
In the wild
Unconfirmed
What it is

PrinceXML, versions 10 and below, is vulnerable to XXE due to the lack of protection against external entities. If an attacker passes HTML referencing an XML file (e.g., in an IFRAME element), PrinceXML will fetch the XML and parse it, thus giving an attacker file-read access and full-fledged SSRF.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02597 · 85.2th percentile
Published
2019-01-29T23:00Z
EPSS history
Timeline
  • 29 JAN 23:00Z
    PrinceXML, versions 10 and below, is vulnerable to XXE due to the lack of protection against external entities
    cvelistv5