CVE-2024-9044

XML External Entity (XXE) Vulnerability in EasyTax

State: Published
Severity: 4.6 Medium
Published: Nov 29, 2024
Updated: Nov 29, 2024
Reserved: Sep 20, 2024

Description

A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Linux, and macOS.

Scores

CVSS	Score	Vector	Source
4.0	4.6 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:N/SA:L	NCSC.ch

Weaknesses

CWE-611 Improper Restriction of XML External Entity Reference
CWE-827 Improper Control of Document Type Definition

Affected Products

Product	Versions
EasyTaxmsg Suisse AG	2023 through 1.2Affected 2022 through 1.3Affected <= 2021 and laterAffected

References

https://www.ag.ch/de/verwaltung/dfr/steuern/natuerliche-personen/steuererklaerung-easytax

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.