CVE search · CVE-2024-40896
CVE-2024-40896
critical 9.1
In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.
Details
- Status
- Analyzed
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- CWE-611
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | critical 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- xmlsoft · libxml2
- netapp · hci_compute_node
- netapp · solidfire_&_hci_management_node
- netapp · solidfire_&_hci_storage_node
- netapp · h300s_firmware
- netapp · h410s_firmware
- netapp · h500s_firmware
- netapp · h700s_firmware
- netapp · h410c_firmware
References
- https://gitlab.gnome.org/GNOME/libxml2/-/commit/1a8932303969907f6572b1b6aac4081c56adb5c6Issue Tracking
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/761Issue Tracking
- https://security.netapp.com/advisory/ntap-20250228-0004/Third Party Advisory