CVE-2012-1102: XEE
It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untrusted sources. This may allow attackers to gain read access to otherwise protected resources, depending on how the library is used.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using XML::Atom versions earlier than 0.39 to parse XML from potentially untrusted sources are exposed. Exposure depends on how the application supplies XML to the library and what resources the parser can access.
What does an attacker need to exploit it?
An attacker needs to cause the application to parse attacker-controlled XML using an affected XML::Atom version. No authentication or user interaction is indicated by the supplied CVSS vector.
What can an attacker access?
The issue may allow read access to otherwise protected resources through XML external entity processing. The specific resources exposed depend on the application's environment and parser access.
How can the issue be remediated?
Upgrade XML::Atom to version 0.39 or later. Version 0.39 disables external entities when parsing XML.