CVE-2019-13358 - lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system

Back Back to CVE browser

HIGH

lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system

Published Jul 5, 2019

7.5

HIGH

CVSS 3.1

EPSS 24.27%

Description

lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

References (4)

http://packetstormsecurity.com/files/164253/OpenCats-0.9.4-2-XML-Injection.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://www.opencats.org/news/
x_refsource_MISCRelease NotesVendor Advisory
https://doddsecurity.com/312/xml-external-entity-injection-xxe-in-opencats-applicant-tracking-system/
x_refsource_MISCExploitThird Party Advisory
https://github.com/opencats/OpenCATS/pull/440
x_refsource_MISCIssue TrackingThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/164253/OpenCats-0.9.4-2-XML-Injection.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://www.opencats.org/news/		x_refsource_MISCRelease NotesVendor Advisory
https://doddsecurity.com/312/xml-external-entity-injection-xxe-in-opencats-applicant-tracking-system/		x_refsource_MISCExploitThird Party Advisory
https://github.com/opencats/OpenCATS/pull/440		x_refsource_MISCIssue TrackingThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jul 5, 2019

Updated Aug 4, 2024

Reserved Jul 5, 2019

Link CVE-2019-13358

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-13358

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-13358