Vulnerabilities > CVE-2023-34411 - XXE vulnerability in XML Library Project XML Library

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

xml-library-project

CWE-611

NVD

Published: 2023-06-05

Updated: 2024-11-21

Summary

The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.

Vulnerable Configurations

Part	Description	Count
Application	Xml_Library_Project XML Library Project XML Library - XML Library Project XML Library 0.2.2 XML Library Project XML Library 0.3.6 XML Library Project XML Library 0.3.7 XML Library Project XML Library 0.3.8 XML Library Project XML Library 0.4.0 XML Library Project XML Library 0.5.0 XML Library Project XML Library 0.6.0 XML Library Project XML Library 0.6.1 XML Library Project XML Library 0.6.2 XML Library Project XML Library 0.7.0 XML Library Project XML Library 0.8.0 XML Library Project XML Library 0.8.1 XML Library Project XML Library 0.8.2 XML Library Project XML Library 0.8.3 XML Library Project XML Library 0.8.4 XML Library Project XML Library 0.8.5 XML Library Project XML Library 0.8.6 XML Library Project XML Library 0.8.7 XML Library Project XML Library 0.8.8 XML Library Project XML Library 0.8.9 XML Library Project XML Library 0.8.10 XML Library Project XML Library 0.8.11 XML Library Project XML Library 0.8.12 XML Library Project XML Library 0.8.13	25

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References