CVE-2024-6893 Journyx Unauthenticated XML External Entities Injection
Unauthenticated attackers can exploit XML External Entity injection in the SOAP API to read local files and cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6893?
CVE-2024-6893 is a high-severity vulnerability in Journyx (jtime), published on 7 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.
Weakness: CWE-611
Which versions are affected by CVE-2024-6893?
It affects 1 product.
Products include Journyx Journyx.
How do I fix CVE-2024-6893?
No fix has been published for CVE-2024-6893 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-6893 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6893 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Journyx (jtime)
Sources
Also known as GHSA-9hxq-vv35-9r5r.