CVE-2019-9757 XML external entity in n/a
Attackers can read local files by sending SVGs with XXE payloads to LabKey Server export endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-9757?
CVE-2019-9757 is a high-severity vulnerability in n/a, published on 29 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read.
Weakness: CWE-611
Which versions are affected by CVE-2019-9757?
It affects 1 product.
Products include Labkey Labkey Server.
How do I fix CVE-2019-9757?
No fix has been published for CVE-2019-9757 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-9757 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-9757 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
Sources
Also known as GHSA-4rf8-j9gh-8qph.