CVE-2020-14029

HIGH

Ozeki NG SMS Gateway < 4.17.6 - XML External Entity Injection in RSS To SMS Module

Title source: llm
STIX 2.1

Description

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an XML External Entity attack that can be used to perform SSRF or read arbitrary local files.

References (2)

Core 2
Core References
Vendor Advisory x_refsource_misc
http://www.ozeki.hu/index.php?owpn=231

Scores

CVSS v3 7.5
EPSS 0.0138
EPSS Percentile 68.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-611
Status published
Products (1)
ozeki/ozeki_ng_sms_gateway < 4.17.6
Published Sep 18, 2020
Tracked Since Feb 18, 2026