CVE-2017-10670

CRITICAL

OSCI Transport Library 1.6.1 (Java) and 1.6 (.NET) - XML External Entity Injection via OSCI Message

Title source: llm

Description

An XML External Entity (XXE) issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET), exploitable by sending a crafted standard-conforming OSCI message from within the infrastructure.

References (2)

Core 2

Core References

Mailing List, Third Party Advisory x_refsource_misc

http://seclists.org/fulldisclosure/2017/Jun/44

Technical Description, Third Party Advisory

http://blog.sec-consult.com/2017/06/german-e-government-details-vulnerabilities.html

Scores

CVSS v3 9.8

EPSS 0.0135

EPSS Percentile 68.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-611

Status published

Products (2)

xoev/osci_transport_library 1.6

xoev/osci_transport_library 1.6.1

Published Jun 30, 2017

Tracked Since Feb 18, 2026