CVE-2019-13358

High

lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The…

mitre·CWE-611·Published 2019-07-05

CVSS

7.5

EPSS

0.24

KEV

Exploits

cve.orgen

191 chars

lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format.

NVDen

191 chars

lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format.

En la biblioteca lib/DocumentToText.php en OpenCats anterior a versión 0.9.4-3, presenta un problema de tipo XXE que permite a los usuarios remotos leer archivos en el sistema operativo subyacente.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	5.0	10.0	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N
3.1	Primary	NVD	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N