CVE-2019-13625
CRITICALGhidra < 9.0.1 - XML External Entity Injection via Project File Import
Title source: llmDescription
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file.
References (3)
Core 3
Core References
Exploit, Third Party Advisory x_refsource_misc
http://blog.fxiao.me/ghidra/
Exploit, Third Party Advisory x_refsource_misc
https://xlab.tencent.com/en/2019/03/18/ghidra-from-xxe-to-rce/
Exploit, Third Party Advisory x_refsource_misc
https://github.com/NationalSecurityAgency/ghidra/issues/71
Scores
CVSS v3
9.1
EPSS
0.0240
EPSS Percentile
81.9%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Details
CWE
CWE-611
Status
published
Products (1)
nsa/ghidra
< 9.0.1
Published
Jul 17, 2019
Tracked Since
Feb 18, 2026