Published: 02/05/2013 Updated: 10/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 505

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

The Java XML parser in Echo prior to 2.1.1 and 3.x prior to 3.0.b6 allows remote malicious users to read arbitrary files via a request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Vulnerable Product	Search on Vulmon	Subscribe to Product
nextapp echo 2.1.0
nextapp echo 2.0
nextapp echo
nextapp echo 2.0.1
nextapp echo 3.0

SEC Consult Security Advisory < 20090305-0 > ======================================================================== title: NextApp Echo XML Injection Vulnerability program: NextApp Echo vulnerable version: Echo2 < 211 homepage: echonextappcom/site/echo2 fo ...

CWE-20 http://www.vupen.com/english/advisories/2009/0653 http://www.exploit-db.com/exploits/8191/http://secunia.com/advisories/34218 http://echo.nextapp.com/site/node/5742 https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20090305-0_echo_nextapp_xml_injection.txt https://exchange.xforce.ibmcloud.com/vulnerabilities/49167 http://www.securityfocus.com/archive/1/501637/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/8191/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2009-5135

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect