It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untrusted sources. This may allow attackers to gain read access to otherwise protected resources, depending on how the library is used.
Applications using XML::Atom versions earlier than 0.39 to parse XML from potentially untrusted sources are exposed. Exposure depends on how the application supplies XML to the library and what resources the parser can access.
An attacker needs to cause the application to parse attacker-controlled XML using an affected XML::Atom version. No authentication or user interaction is indicated by the supplied CVSS vector.
The issue may allow read access to otherwise protected resources through XML external entity processing. The specific resources exposed depend on the application's environment and parser access.
Upgrade XML::Atom to version 0.39 or later. Version 0.39 disables external entities when parsing XML.