CVE-2019-13358: XEE
Published Jul 5, 2019
·Updated
lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format.
Affected Software
1 affected component
OpenCATS OpenCATS<0.9.4-3
Event History
Jul 5, 2019
CVE Published
via MITRE·08:26 PM
Data Sourced
via MITRE·08:26 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-13358?
The severity of CVE-2019-13358 is classified as medium, as it allows remote users to read sensitive files on the system.
2
How do I fix CVE-2019-13358?
To fix CVE-2019-13358, upgrade OpenCats to version 0.9.4-3 or later.
3
What does CVE-2019-13358 exploit?
CVE-2019-13358 exploits an XML External Entity (XXE) vulnerability in the DocumentToText.php file.
4
What file types must be uploaded to trigger CVE-2019-13358?
The attacker must upload a file in either the docx or odt format to exploit CVE-2019-13358.
5
Which versions of OpenCats are affected by CVE-2019-13358?
OpenCats versions prior to 0.9.4-3 are affected by CVE-2019-13358.