Vulnerabilities > CVE-2019-20191 - XXE vulnerability in Sync Oxygen XML Editor

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

sync

CWE-611

NVD

Published: 2020-03-16

Updated: 2023-11-07

Summary

Oxygen XML Editor 21.1.1 allows XXE to read any file.

Vulnerable Configurations

Part	Description	Count
Application	Sync Sync Oxygen XML Editor 1.0 Sync Oxygen XML Editor 1.1 Sync Oxygen XML Editor 1.1.5 Sync Oxygen XML Editor 1.1.6 Sync Oxygen XML Editor 1.1.7 Sync Oxygen XML Editor 1.1.8 Sync Oxygen XML Editor 1.1.9 Sync Oxygen XML Editor 1.2 Sync Oxygen XML Editor 1.2.1 Sync Oxygen XML Editor 1.2.2 Sync Oxygen XML Editor 1.2.3 Sync Oxygen XML Editor 1.2.4 Sync Oxygen XML Editor 2.0 Sync Oxygen XML Editor 2.0.1 Sync Oxygen XML Editor 2.0.2 Sync Oxygen XML Editor 2.0.3 Sync Oxygen XML Editor 2.0.4 Sync Oxygen XML Editor 3.0 Sync Oxygen XML Editor 3.1 Sync Oxygen XML Editor 4.0 Sync Oxygen XML Editor 4.1 Sync Oxygen XML Editor 4.2 Sync Oxygen XML Editor 5.0 Sync Oxygen XML Editor 5.1 Sync Oxygen XML Editor 6.0 Sync Oxygen XML Editor 6.1 Sync Oxygen XML Editor 6.2 Sync Oxygen XML Editor 7.0 Sync Oxygen XML Editor 7.1 Sync Oxygen XML Editor 7.2 Sync Oxygen XML Editor 8.0 Sync Oxygen XML Editor 8.1 Sync Oxygen XML Editor 8.2 Sync Oxygen XML Editor 9.0 Sync Oxygen XML Editor 9.1 Sync Oxygen XML Editor 9.2 Sync Oxygen XML Editor 9.3 Sync Oxygen XML Editor 10.0 Sync Oxygen XML Editor 10.1 Sync Oxygen XML Editor 10.2 Sync Oxygen XML Editor 10.3 Sync Oxygen XML Editor 11.0 Sync Oxygen XML Editor 11.1 Sync Oxygen XML Editor 11.2 Sync Oxygen XML Editor 12.0 Sync Oxygen XML Editor 12.1 Sync Oxygen XML Editor 12.2 Sync Oxygen XML Editor 13.0 Sync Oxygen XML Editor 13.1 Sync Oxygen XML Editor 13.2 Sync Oxygen XML Editor 18.0 Sync Oxygen XML Editor 18.0.1 Sync Oxygen XML Editor 18.1 Sync Oxygen XML Editor 19.0 Sync Oxygen XML Editor 19.1 Sync Oxygen XML Editor 20.0 Sync Oxygen XML Editor 20.1 Sync Oxygen XML Editor 21.0 Sync Oxygen XML Editor 21.1 Sync Oxygen XML Editor 21.1.1 Sync Oxygen XML Author 20.0 Sync Oxygen XML Author 20.1 Sync Oxygen XML Author 21.0 Sync Oxygen XML Author 21.1 Sync Oxygen XML Developer 20.0 Sync Oxygen XML Developer 20.1 Sync Oxygen XML Developer 21.0 Sync Oxygen XML Developer 21.1	68

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

References

https://medium.com/%40Pablo0xSantiago/cve-2019-20191-oxygen-xml-editor-21-1-1-allows-xxe-216b816f312b