CVE-2023-26267: XEE
php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities was silently enabled via \LIBXMLDTDLOAD | \LIBXMLDTDATTR.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-26267?
CVE-2023-26267 is considered a high-severity vulnerability due to its ability to allow unauthorized file reading on the server.
How do I fix CVE-2023-26267?
To fix CVE-2023-26267, upgrade to php-saml-sp version 1.1.1 or 2.1.1 and configure your application to disable XML external entity processing.
What types of systems are affected by CVE-2023-26267?
CVE-2023-26267 affects php-saml-sp versions prior to 1.1.1 and between 2.0.0 and 2.1.1.
What kind of attacks can exploit CVE-2023-26267?
CVE-2023-26267 can be exploited to read arbitrary files from the server, potentially exposing sensitive information.
Is CVE-2023-26267 related to XML parsing vulnerabilities?
Yes, CVE-2023-26267 is related to XML parsing vulnerabilities due to the enabling of XML external entity resolution.