XML External Entity (XXE) Injection Affecting nokogiri package, versions >=1.6, <1.6.1 <1.5.11
Threat Intelligence
EPSS
0.42% (75th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-NOKOGIRI-20127
- published 13 Dec 2013
- disclosed 13 Dec 2013
- credit Jonas Nicklas
Introduced: 13 Dec 2013
CVE-2013-6461 Open this link in a new tabHow to fix?
Upgrade nokogiri to versions 1.5.11, 1.6.1 or higher.
Overview
nokogiri is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.
Affected versions of this Gem are vulnerable to Denial of Service (DoS) attacks. It contains an flaw that is triggered during the parsing of XML data. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can cause an infinite loop and crash the program.
References
CVSS Scores
version 3.1