XML External Entity (XXE) Injection Affecting nokogiri package, versions >=1.6, <1.6.1<1.5.11


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.39% (74th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about XML External Entity (XXE) Injection vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RUBY-NOKOGIRI-20127
  • published13 Dec 2013
  • disclosed13 Dec 2013
  • creditJonas Nicklas

Introduced: 13 Dec 2013

CVE-2013-6461  (opens in a new tab)
CWE-400  (opens in a new tab)

How to fix?

Upgrade nokogiri to versions 1.5.11, 1.6.1 or higher.

Overview

nokogiri is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.

Affected versions of this Gem are vulnerable to Denial of Service (DoS) attacks. It contains an flaw that is triggered during the parsing of XML data. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can cause an infinite loop and crash the program.

CVSS Scores

version 3.1