CVE-2020-21524: XEE
There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needs to parse the xml file, but it is not used for security defense, This vulnerability can detect the intranet, read files, enable ddos attacks, etc. exp:https://github.com/halo-dev/halo/issues/423
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-21524?
CVE-2020-21524 is considered a critical vulnerability due to its potential to exfiltrate data and enable denial of service attacks.
How do I fix CVE-2020-21524?
To fix CVE-2020-21524, update to the latest version of Halo where the vulnerability has been addressed.
What is the nature of the vulnerability in CVE-2020-21524?
CVE-2020-21524 is an XML External Entity (XXE) vulnerability that allows attackers to exploit file handling through XML parsing.
What kind of attacks can be performed using CVE-2020-21524?
Attackers can use CVE-2020-21524 to read sensitive files, conduct reconnaissance, and initiate DDoS attacks.
Which software versions are affected by CVE-2020-21524?
Only Halo version 1.1.3 is affected by CVE-2020-21524, making it critical for users of this version to take action.