CVE-2025-35112

Katalog CVE

CVSS 4.9 · Medium EPSS 0,31%

Kerentanan Improper Restriction of XML External Entity Reference pada atlassian agiloft. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the template file and perform path traversal on the local system files. Users should upgrade to Agiloft Release 31.

Rincian

Terbit di NVD

26 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wiki.agiloft.com/display/HELP/What%27s+New%3A+CVE+Resolution release notes · advisory vendor
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-239-01.json advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2025-35112 advisory pihak ketiga