high7.4Public exploit code
CVE-2017-9355
XML external entity (XXE) vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers to conduct server-side request forgery (S…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Subsonic 6.1.1 - XML External Entity Injection2017-06-05 · local · windows · Verified
Impact
XML external entity (XXE) vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted XSPF playlist file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Subsonic | Subsonic | Version 6.1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://hyp3rlinx.altervista.org/advisories/SUBSONIC-XML-EXTERNAL-ENITITY.txt
- http://packetstormsecurity.com/files/142795/Subsonic-6.1.1-XML-External-Entity-Attack.html
- https://www.exploit-db.com/exploits/42119/
- http://hyp3rlinx.altervista.org/advisories/SUBSONIC-XML-EXTERNAL-ENITITY.txt
- http://packetstormsecurity.com/files/142795/Subsonic-6.1.1-XML-External-Entity-Attack.html
- https://www.exploit-db.com/exploits/42119/