« Volver al listado

CVE-2026-3511

Estado: Pendiente de análisisAlta (8.6)—

Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to conduct SSRF (Server Side Request Forgery) attacks and obtain unauthorized access to local files on filesystems running the vulnerable application. Successful exploitation requires the victim to visit a specially crafted website that sends request containing a specially crafted XML document to /sign endpoint of the local HTTP server run by the application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkFilter Network TrafficApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Slovensko.digital — AutogramAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-3511",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-3511",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-19T13:14:58.232031Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "incident@nbu.gov.sk",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "incident@nbu.gov.sk",
      "affectedData": [
        {
          "vendor": "Slovensko.Digital",
          "product": "Autogram",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.7.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-19T12:16:18.647",
  "references": [
    {
      "url": "https://blog.binary.house/2026/03/pripadova-studia-ako-sme-s-claude-code.html",
      "source": "incident@nbu.gov.sk"
    },
    {
      "url": "https://github.com/slovensko-digital/autogram/releases/tag/v2.7.2",
      "source": "incident@nbu.gov.sk"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "incident@nbu.gov.sk",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to conduct SSRF (Server Side Request Forgery) attacks and obtain unauthorized access to local files on filesystems running the vulnerable application. Successful exploitation requires the victim to visit a specially crafted website that sends request containing a specially crafted XML document to /sign endpoint of the local HTTP server run by the application."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Restricción Inadecuada de Referencia a Entidad Externa XML en XMLUtils.java en Slovensko.Digital Autogram permite a un atacante remoto no autenticado realizar ataques SSRF (Server Side Request Forgery) y obtener acceso no autorizado a archivos locales en sistemas de archivos que ejecutan la aplicación vulnerable. La explotación exitosa requiere que la víctima visite un sitio web especialmente diseñado que envía una solicitud que contiene un documento XML especialmente diseñado al endpoint /sign del servidor HTTP local ejecutado por la aplicación."
    }
  ],
  "lastModified": "2026-06-17T10:43:41.763",
  "sourceIdentifier": "incident@nbu.gov.sk"
}