{"id":"GHSA-qvwf-w35m-6r95","aliases":["CVE-2017-1000477"],"title":"XXE Vulnerability in XMLBundle 0.1.7","description":"XMLBundle version 0.1.7 is vulnerable to XXE attacks which can result in denial of service attacks.","severity":"high","score":7.5,"published":"2022-05-14T03:49:52.000Z","modified":"2024-02-16T08:23:01.218Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"desperado/xml-bundle","ranges":[{"events":[{"introduced":"0"},{"last_affected":"0.1.7"}],"type":"ECOSYSTEM"}],"versions":["0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7"],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2017-1000477","https://github.com/pravednik/xmlBundle/issues/2","https://github.com/pravednik/xmlBundle/pull/5/commits/803d8cb34b972e67c2144b8b36575f97d14ef1d6"],"sources":[{"name":"OSV","id":"GHSA-qvwf-w35m-6r95","modified":"2024-02-16T08:23:01.218286Z","url":"https://osv.dev/vulnerability/GHSA-qvwf-w35m-6r95"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}]}