CyberRota Analysis
AI-GeneratedThe vulnerability arises when XML batch processing is enabled with the XPath option, allowing unfiltered raw batch input to be processed through a default XPath/JAXP configuration, which lacks entity restrictions. This oversight can lead to XML External Entity (XXE) injection attacks, potentially resulting in data exfiltration and denial-of-service conditions. Organizations utilizing XML batch processing in their applications should prioritize addressing this vulnerability to safeguard against these significant security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks.