Description

The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explosion."

Remediation

References

CVE-2008-3790

Related Vulnerabilities

Twisted Web HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-39348)

Ruby on Rails Improper Input Validation Vulnerability (CVE-2016-2098)

WordPress Plugin Contact Form Builder-a plugin for creating contact and feedback forms Cross-Site Request Forgery (1.0.68)

Joomla Other Vulnerability (CVE-2023-23752)

Oracle JRE CVE-2013-0427 Vulnerability (CVE-2013-0427)

Severity

Medium

Classification

CVE-2008-3790 CWE-20

Tags

Missing Update Known Vulnerabilities