Description

XXE issue in Airsonic before 10.1.2 during parse.

Remediation

References

https://github.com/airsonic/airsonic/blob/master/CHANGELOG.md

https://github.com/airsonic/airsonic/releases/tag/v10.2.1

Related Vulnerabilities

CVE-2019-20922 Vulnerability in npm package handlebars

CVE-2021-30246 Vulnerability in npm package jsrsasign

CVE-2021-32859 Vulnerability in npm package baremetrics-calendar

CVE-2020-2239 Vulnerability in maven package org.jenkins-ci.plugins:parameterized-remote-trigger

CVE-2021-33587 Vulnerability in npm package css-what

Severity

Critical

Classification

CWE-611 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Release Notes Third Party Advisory