CVE-2014-4374 — XML External Entity (XXE) Injection in Apple Iphone OS

2 documents2 sources
Severity
5.0MEDIUMNVD
EPSS
0.5%
top 33.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apple Iphone OSApple MAC OS X
Timeline
PublishedSep 18
Latest updateMay 17

Description

NSXMLParser in Foundation in Apple iOS before 8 allows attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶NVDapple/mac_os_x10.9.4
▶NVDapple/iphone_os7.1.2+9

🔴Vulnerability Details

1
GHSA
GHSA-88pj-vv22-37g3: NSXMLParser in Foundation in Apple iOS before 8 allows attackers to read arbitrary files via XML data containing an external entity declaration in con↗2022-05-17
▶