Successful exploitation of this vulnerability could allow an attacker to disclose sensitive information.
The following versions of NSA GRASSMARLIN are affected:
GRASSMARLIN vers:all/*
Vendor
Equipment
NSA
NSA GRASSMARLIN
Improper Restriction of XML External Entity Reference
Critical Infrastructure Sectors: Information Technology
Countries/Areas Deployed: Worldwide
Company Headquarters Location: United States
A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process.
NSA GRASSMARLIN
Relevant CWE: CWE-611 Improper Restriction of XML External Entity Reference
Metrics
Base Score
Base Severity
Vector String
3.1
5.5
MEDIUM
Acknowledgments
Grady DeRosa reported this vulnerability to CIS...