CVE-2020-26564

ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic survey…

published July 31, 2021

CVSS
—
EPSS
1%
Percentile
65.9
In the wild
Unconfirmed
What it is

ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic survey template (containing a link to this .css file), and import this .xml file at the survey/admin/folderSurvey.do?action=viewImportSurvey['importFile'] URI. The XXE can then be triggered at a admin/preview.do?action=previewSurvey&surveyId= URI.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01121 · 65.9th percentile
Published
2021-07-31T16:28Z
EPSS history
Timeline
  • 31 JUL 16:28Z
    ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic survey…
    cvelistv5