2 lines
2.6 KiB
JSON
2 lines
2.6 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Autogram","vendor":"Slovensko.Digital","versions":[{"lessThan":"2.7.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"incident@nbu.gov.sk"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to conduct SSRF (Server Side Request Forgery) attacks and obtain unauthorized access to local files on filesystems running the vulnerable application. Successful exploitation requires the victim to visit a specially crafted website that sends request containing a specially crafted XML document to /sign endpoint of the local HTTP server run by the application."},{"lang":"es","value":"Vulnerabilidad de Restricción Inadecuada de Referencia a Entidad Externa XML en XMLUtils.java en Slovensko.Digital Autogram permite a un atacante remoto no autenticado realizar ataques SSRF (Server Side Request Forgery) y obtener acceso no autorizado a archivos locales en sistemas de archivos que ejecutan la aplicación vulnerable. La explotación exitosa requiere que la víctima visite un sitio web especialmente diseñado que envía una solicitud que contiene un documento XML especialmente diseñado al endpoint /sign del servidor HTTP local ejecutado por la aplicación."}],"id":"CVE-2026-3511","lastModified":"2026-06-17T10:43:41.763","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"incident@nbu.gov.sk","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3511","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-19T13:14:58.232031Z","version":"2.0.3"}}]},"published":"2026-03-19T12:16:18.647","references":[{"source":"incident@nbu.gov.sk","url":"https://blog.binary.house/2026/03/pripadova-studia-ako-sme-s-claude-code.html"},{"source":"incident@nbu.gov.sk","url":"https://github.com/slovensko-digital/autogram/releases/tag/v2.7.2"}],"sourceIdentifier":"incident@nbu.gov.sk","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"incident@nbu.gov.sk","type":"Secondary"}]}
|