Security Advisory

CVE-2010-3260

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2011-04-27 00:00:00

Last updated 2024-09-17 03:54:25

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component in the XForms service in Orbeon Forms before 3.9 does not properly restrict DTDs in Ajax requests, which allows remote attackers to read arbitrary files or send HTTP requests to intranet servers via an entity declaration in conjunction with an entity reference, related to an "XML injection" issue.

← Browse all CVEs View on cve.org ↗