Loading vulnerability details...
When an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML.
Malicious Input
{
a: {
"@_attr": '" onClick="alert(1)'
}
}
Output
<a attr="" onClick="alert(1)"></a>
If you're not ignoring attributes then keep processEntities flag true.
When an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML.
Malicious Input
{
a: {
"@_attr": '" onClick="alert(1)'
}
}
Output
<a attr="" onClick="alert(1)"></a>
If you're not ignoring attributes then keep processEntities flag true.
This medium-severity vulnerability could be exploited under certain conditions to compromise security controls or access sensitive information. Should be addressed in a timely manner.
Probability of exploitation in the next 30 days · more likely than 15.4% of all CVEs.
Apply security patches to version 1.1.7 immediately
Isolate affected systems from untrusted networks until patching is complete
Implement enhanced monitoring for exploitation attempts and unusual behavior