Description

XXE issue in Airsonic before 10.1.2 during parse.

Remediation

References

https://github.com/airsonic/airsonic/releases/tag/v10.2.1

https://github.com/airsonic/airsonic/blob/master/CHANGELOG.md

Related Vulnerabilities

CVE-2023-36478 Vulnerability in maven package org.eclipse.jetty.http2:http2-hpack

CVE-2023-44487 Vulnerability in maven package org.apache.tomcat:tomcat-coyote

CVE-2019-6283 Vulnerability in npm package node-sass

CVE-2022-22984 Vulnerability in npm package snyk-python-plugin

CVE-2018-25053 Vulnerability in npm package node-json2html

Severity

Critical

Classification

CWE-611 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Release Notes Third Party Advisory