CVE-2021-32754CWE-611

Improper Restriction of XML External Entity Reference in de.tud.sse

Medium · published July 12, 2021

CVSS v3.1
5.3
EPSS
1%
Percentile
50.2
In the wild
Unconfirmed
What it is

FlowDroid is a data flow analysis tool. FlowDroid versions prior to 2.9.0 contained an XML external entity (XXE) vulnerability that allowed an attacker who had control over the source/sink definition file in XML format to read files from external locations. In order for this to occur, the XML-based format for sources and sinks had to be used and the attacker had to able control the source/sink definition file. The vulnerability was patched in version 2.9.0. As a workaround, do not allow untrusted entities to control the source/sink definition file.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00643 · 50.2th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2021-07-12T23:00Z
EPSS history
Timeline
  • 12 JUL 23:00Z
    Improper Restriction of XML External Entity Reference in de.tud.sse
    cvelistv5