Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2009-2473 — Neon vulnerability

6 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
12.4%
top 6.08%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Webdav NeonDebian Neon27
Timeline
PublishedAug 21
Latest updateMay 2

Description

neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

CVSS vector

AV:N/AC:M/C:N/I:N/A:PExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶NVDwebdav/neon0.28.6
▶debiandebian/neon27

Patches

Patch: www.vupen.com ↗Patch: www.vupen.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-9vc6-7j3x-7x4v: neon before 0↗2022-05-02
▶

💥Exploits & PoCs

1
Exploit-DB
Expat 2.0.1 - UTF-8 Character XML Parsing Remote Denial of Service↗2009-11-12
▶

📋Vendor Advisories

2
Red Hat
neon: billion laughs DoS attack↗2009-08-18
▶
Debian
CVE-2009-2473: neon27 - neon before 0.28.6, when expat is used, does not properly detect recursion durin...↗2009
▶

💬Community

1
Bugzilla
CVE-2009-2473 neon: billion laughs DoS attack↗2009-08-19
▶