CVE-2014-3242

SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2014-05-12

Last modified

2024-08-06

Weaknesses

CWE-200

Affected products

• Soappy (Makina-corpus)

References

• http://seclists.org/fulldisclosure/2014/May/20
• http://www.openwall.com/lists/oss-security/2014/05/06/1
• http://www.openwall.com/lists/oss-security/2014/05/06/9
• http://www.pnigos.com/?p=260
• http://www.securityfocus.com/bid/67216