CVE-2024-29010CWE-611

The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the disclosure of…

High · published May 1, 2024

CVSS v3.1
7.1
EPSS
1%
Percentile
49.1
In the wild
Unconfirmed
What it is

The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the disclosure of sensitive information.

This issue affects GMS: 9.3.4 and earlier versions.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00621 · 49.1th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2024-05-01T18:12Z
EPSS history
Timeline
  • 01 MAY 18:12Z
    The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the disclosure of…
    cvelistv5