CVE-2024-29010
Assigner: sonicwall
Published: 2024-05-01T18:12:53.853Z
State: PUBLISHED
affected: defaultStatus: unknown
product: GMS
vendor: SonicWall
versions: status: affected
version: 9.3.4 and earlier versions
datePublic: 2024-05-01T17:42:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the disclosure of sensitive information.<br><br>This issue affects GMS: 9.3.4 and earlier versions.<p></p>
value: The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the disclosure of sensitive information.

This issue affects GMS: 9.3.4 and earlier versions.


impacts: capecId: CAPEC-250
descriptions: value: CAPEC-250 XML Injection
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
type: CWE
source: advisory: SNWLID-2024-0007
discovery: EXTERNAL
x_generator: engine: Vulnogram 0.1.0-dev