CVE-2025-34142

MEDIUM

ETQ Reliance CG (legacy) < SE.2025.1 and < 2025.1.2 - XML External Entity Injection in SAML SSO Handler

Title source: llm

Description

An XML External Entity (XXE) injection vulnerability exists in ETQ Reliance on the CG (legacy) platform within the `/resources/sessions/sso` endpoint. The SAML authentication handler processes XML input without disabling external entity resolution, allowing crafted SAML responses to invoke external entity references. This could enable attackers to retrieve sensitive files or perform server-side request forgery (SSRF). The issue was addressed by disabling external entity processing for the affected XML parser in versions SE.2025.1 and 2025.1.2.

References (4)

Core 4

Core References

Various Sources product

https://www.etq.com/product-overview/

Various Sources vendor-advisory patch

https://www.etq.com/blog/etq-reliance-security-update/

Various Sources technical-description

https://slcyber.io/assetnote-security-research-center/how-we-accidentally-discovered-a-remote-code-execution-vulnerability-in-etq-reliance/

Third Party Advisory third-party-advisory

https://www.vulncheck.com/advisories/etq-reliance-cg-xxe-injection-in-sso-saml-handler-copy

Scores

CVSS v4 6.9

EPSS 0.0110

EPSS Percentile 61.1%

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-611

Status published

Products (2)

ETQ/Reliance CG (legacy) < 2025.1.2

ETQ/Reliance CG (legacy) < SE.2025.1

Published Jul 22, 2025

Tracked Since Feb 18, 2026