Vulnerability Details
Severity:
High
Category:
web
Description
The application parses XML input with external entity processing enabled, allowing attackers to include malicious external entities in XML documents.
Risks
An attacker could read local files, perform SSRF attacks, execute denial of service, or potentially achieve remote code execution.
Remediation
Disable DTD processing and external entity resolution in XML parsers. Use less complex data formats like JSON where possible. Validate and sanitize XML input. Keep XML parsing libraries updated.