SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2020-21524

There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needs to parse the xml file, but it is not used for security defense, This vulnerability can…

CRITICAL 9.1EPSS 1.51%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.51%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needs to parse the xml file, but it is not used for security defense, This vulnerability can detect the intranet, read files, enable ddos attacks, etc. exp:https://github.com/halo-dev/halo/issues/423

CVSS 3.1
9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS
1.51% probability · 73th percentile
CISA KEV
Not listed
Weakness
CWE-611
Affected
halo/halo
Source
cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.