« Volver al listado

CVE-2019-20191

Estado: ModificadaAlta (7.5)—

Oxygen XML Editor 21.1.1 allows XXE to read any file.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Sync — Oxygen XML AuthorSync — Oxygen XML DeveloperSync — Oxygen XML Editor

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-20191",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-03-16T22:15:14.527",
  "references": [
    {
      "url": "https://medium.com/%40Pablo0xSantiago/cve-2019-20191-oxygen-xml-editor-21-1-1-allows-xxe-216b816f312b",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://medium.com/%40Pablo0xSantiago/cve-2019-20191-oxygen-xml-editor-21-1-1-allows-xxe-216b816f312b",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Oxygen XML Editor 21.1.1 allows XXE to read any file."
    },
    {
      "lang": "es",
      "value": "Oxygen XML Editor versión 21.1.1, permite un ataque de tipo XXE para leer cualquier archivo."
    }
  ],
  "lastModified": "2026-06-17T02:30:10.997",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sync:oxygen_xml_author:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EFE14507-5608-4212-868D-6D5FFB75720C",
              "versionEndIncluding": "21.1"
            },
            {
              "criteria": "cpe:2.3:a:sync:oxygen_xml_developer:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3881566-F3D9-421C-8807-85D9C3A432CB",
              "versionEndIncluding": "21.1"
            },
            {
              "criteria": "cpe:2.3:a:sync:oxygen_xml_editor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9CC3AB48-11D4-48BE-AB1A-AD01D1C9B1CF",
              "versionEndIncluding": "21.1.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}