mirror of
https://github.com/0xMarcio/cve.git
synced 2025-05-06 10:41:43 +00:00
19 lines
746 B
Markdown
19 lines
746 B
Markdown
|
### [CVE-2016-8739](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8739)
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
### Description
|
||
|
|
|
||
|
|
The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk.
|
||
|
|
|
||
|
|
### POC
|
||
|
|
|
||
|
|
#### Reference
|
||
|
|
No PoCs from references.
|
||
|
|
|
||
|
|
#### Github
|
||
|
|
- https://github.com/0ang3el/Unsafe-JAX-RS-Burp
|
||
|
|
- https://github.com/ARPSyndicate/cvemon
|
||
|
|
|