CVE-2019-1187

CWE-611 — XML External Entity (XXE)4 documents4 sources
Severity
5.5MEDIUM
EPSS
2.4%
top 14.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
28
Microsoft Windows 10 Version 1507Microsoft Windows 10 Version 1607Microsoft Windows 10 Version 1703+25 more
Timeline
PublishedAug 14
Latest updateMay 24

Description

A denial of service vulnerability exists when the XmlLite runtime (XmlLite.dll) improperly parses XML input. An attacker who successfully exploited this vulnerability could cause a denial of service against an XML application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to an XML application. The update addresses the vulnerability by correcting how the XmlLite runtime parses XML input.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages28 packages

▶CVEListV5microsoft/windows_7_service_pack_16.1.0 — publication
▶CVEListV5microsoft/windows_server_2008_service_pack_26.0.0 — publication
▶CVEListV5microsoft/windows_server_2008_r2_service_pack_16.1.0 — publication

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-69cm-22ph-xrr5: A denial of service vulnerability exists when the XmlLite runtime (XmlLite↗2022-05-24
▶
CVEList
XmlLite Runtime Denial of Service Vulnerability↗2019-08-14
▶

📋Vendor Advisories

1
Microsoft
XmlLite Runtime Denial of Service Vulnerability↗2019-08-13
▶
CVE-2019-1187 (MEDIUM CVSS 5.5) | A denial of service vulnerability e | cvebase.io