CVE-2025-34142CWE-611

ETQ Reliance CG < SE.2025.1 / < 2025.1.2 XXE Injection in SSO SAML Handler

Medium · published July 22, 2025

CVSS v4.0
6.9
EPSS
1%
Percentile
61.1
In the wild
Unconfirmed
What it is

An XML External Entity (XXE) injection vulnerability exists in ETQ Reliance on the CG (legacy) platform within the `/resources/sessions/sso` endpoint. The SAML authentication handler processes XML input without disabling external entity resolution, allowing crafted SAML responses to invoke external entity references. This could enable attackers to retrieve sensitive files or perform server-side request forgery (SSRF). The issue was addressed by disabling external entity processing for the affected XML parser in versions SE.2025.1 and 2025.1.2.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00959 · 61.1th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2025-07-22T12:31Z
EPSS history
Timeline
  • 22 JUL 12:31Z
    ETQ Reliance CG < SE.2025.1 / < 2025.1.2 XXE Injection in SSO SAML Handler
    cvelistv5