CVE-2019-11519: XEE
Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Edit Language -> Import Resources -> Upload XML file" screen.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11519?
CVE-2019-11519 is classified as a critical vulnerability due to its potential for XML External Entity (XXE) injection, which can lead to data exposure.
How do I fix CVE-2019-11519?
To fix CVE-2019-11519, upgrade your nopCommerce installation to version 4.11 or later, which addresses this vulnerability.
What systems are affected by CVE-2019-11519?
CVE-2019-11519 affects nopCommerce versions up to and including 4.10.
What kind of attack is possible with CVE-2019-11519?
CVE-2019-11519 allows attackers to exploit XXE vulnerabilities, potentially leading to unauthorized access to sensitive information.
Can CVE-2019-11519 lead to remote code execution?
CVE-2019-11519 primarily allows for data exposure via XXE but may lead to further attacks depending on the application's environment and configurations.