5
CVSSv2

CVE-2015-3451

Published: 12/05/2015 Updated: 29/04/2020
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Summary

The _clone function in XML::LibXML prior to 2.0119 does not properly set the expand_entities option, which allows remote malicious users to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.

Most Upvoted Vulmon Research Post

There is no Researcher post for this vulnerability
Would you like to share something about it? Sign up now to share your knowledge with the community.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

xml-libxml project xml-libxml

canonical ubuntu linux 12.04

canonical ubuntu linux 14.04

canonical ubuntu linux 14.10

canonical ubuntu linux 15.04

debian debian linux 7.0

debian debian linux 8.0

fedoraproject fedora 20

fedoraproject fedora 21

opensuse opensuse 13.1

opensuse opensuse 13.2

Vendor Advisories

Debian Bug report logs - #783443 libxml-libxml-perl: XEE vulnerability; expand_entities set to 0 is not preserved after a _clone() call (CVE-2015-3451) Package: src:libxml-libxml-perl; Maintainer for src:libxml-libxml-perl is Debian Perl Group <pkg-perl-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso & ...
XML::LibXML could be made to expose sensitive information ...
The _clone function in XML::LibXML before 20119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function ...