Description

The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explosion."

Remediation

References

CVE-2008-3790

Related Vulnerabilities

concrete5 Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2020-24986)

Mibew Messenger Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2012-0829)

Moodle Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2022-0983)

Oracle Application Server CVE-2007-5521 Vulnerability (CVE-2007-5521)

WordPress Plugin WHMCS Bridge Cross-Site Scripting (6.2)

Severity

Medium

Classification

CVE-2008-3790 CWE-20

Tags

Missing Update Known Vulnerabilities