CVE-2010-3260 | BDVDB-2026-45918 Detail

Description#

oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component in the XForms service in Orbeon Forms before 3.9 does not properly restrict DTDs in Ajax requests, which allows remote attackers to read arbitrary files or send HTTP requests to intranet servers via an entity declaration in conjunction with an entity reference, related to an "XML injection" issue.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://wiki.orbeon.com/forms/doc/developer-guide/release-notes/39
http://www.securityfocus.com/bid/47362
http://www.stratsec.net/Research/Advisories/Orbeon-Forms-XML-Entity-Dereferencing-%28SS-2011-004
https://github.com/orbeon/orbeon-forms/commit/aba6681660f65af7f1676434da68c10298c30200

Exploit#

No public exploit known

History#

Version 12011-04-27Record published in the CVE List.
Version 22024-09-17Most recent update recorded in the CVE List.