Ladon Framework For Python 0.9.40 XXE Injection
Posted by deepcore on November 4, 2017 – 6:15 pm
Attackers who can send SOAP messages to a Ladon webservice via the HTTP interface of the Ladon webservice can exploit an XML external entity expansion vulnerability and read local files, forge server side requests or overload the service with exponentially growing memory payloads. Versions 0.9.40 and below are affected.
Post a reply
You must be logged in to post a comment.