CVE-2021-44477 GE Gas Power ToolBoxST Improper Restriction of XML External Entity Reference
An attacker can exploit an XML External Entity vulnerability in GE Gas Power ToolBoxST to disclose and retrieve arbitrary data from the affected node.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-44477?
CVE-2021-44477 is a high-severity vulnerability in GE Gas Power ToolBoxST, published on 25 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project/template file.
Weakness: CWE-611
Which versions are affected by CVE-2021-44477?
It affects 1 product.
Products include Ge Toolboxst.
How do I fix CVE-2021-44477?
No fix has been published for CVE-2021-44477 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-44477 being exploited?
There is no known exploitation of CVE-2021-44477 in the wild and no public exploit code.
Other vulnerabilities in GE Gas Power ToolBoxST
Sources
Also known as GHSA-47r3-3h3h-gh9w.