CVE-2010-3260

State: Published
Severity: Not scored
Published: Apr 27, 2011
Updated: Sep 17, 2024
Reserved: Sep 7, 2010

Description

oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component in the XForms service in Orbeon Forms before 3.9 does not properly restrict DTDs in Ajax requests, which allows remote attackers to read arbitrary files or send HTTP requests to intranet servers via an entity declaration in conjunction with an entity reference, related to an "XML injection" issue.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

http://wiki.orbeon.com/forms/doc/developer-guide/release-notes/39
47362vdb-entry
http://www.stratsec.net/Research/Advisories/Orbeon-Forms-XML-Entity-Dereferencing-%28SS-2011-004
https://github.com/orbeon/orbeon-forms/commit/aba6681660f65af7f1676434da68c10298c30200

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.