From 0341546951725fd2bbf691c54145d5a935b98718 Mon Sep 17 00:00:00 2001 From: Goby <50955360+gobysec@users.noreply.github.com> Date: Tue, 1 Jul 2025 18:51:12 +0800 Subject: [PATCH] Create Akamai CloudTest XML External Entity Injection Vulnerability (CVE-2025-49493).md --- ...ity Injection Vulnerability (CVE-2025-49493).md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 Akamai CloudTest XML External Entity Injection Vulnerability (CVE-2025-49493).md diff --git a/Akamai CloudTest XML External Entity Injection Vulnerability (CVE-2025-49493).md b/Akamai CloudTest XML External Entity Injection Vulnerability (CVE-2025-49493).md new file mode 100644 index 0000000..4a8434e --- /dev/null +++ b/Akamai CloudTest XML External Entity Injection Vulnerability (CVE-2025-49493).md @@ -0,0 +1,14 @@ +**Updated document date: July 1, 2025** + +## Akamai CloudTest /concerto/services/RepositoryService XML External Entity Injection Vulnerability (CVE-2025-49493) +| **Vulnerability** | Akamai CloudTest /concerto/services/RepositoryService XML External Entity Injection Vulnerability (CVE-2025-49493)| +| :----: | :-----| +| **Chinese name** |Akamai CloudTest /concerto/services/RepositoryService XML外部实体注入漏洞（CVE-2025-49493） | +| **CVSS core** | 8.0 | +| **FOFA Query** (click to view the results directly)| [(title="Akamai CloudTest" || body="/imageMaster.png") || (body="Akamai CloudTest build" && body="collector component version")] +| **Number of assets affected** | 5600+ | +| **Description** |Akamai CloudTest is a cloud service product used for testing and optimizing website performance. The SOAP endpoint in the product (e.g., /concerto/services/RepositoryService) contains an XML External Entity (XXE) injection vulnerability. Due to improper disabling of DTD processing, attackers can read sensitive files on the server (e.g., /etc/passwd) through carefully crafted XML requests. | +| **Impact** | This vulnerability is low in exploitation difficulty but severe in impact, allowing attackers to steal sensitive system information. Enterprises are advised to immediately apply the latest patch provided by Akamai to mitigate the risk.| +| **Affected versions** | version <12988 + +![](https://s3.bmp.ovh/imgs/2025/07/01/4a8f3c2c7afa2e0c.gif)