CVE-2024-28757
HIGH 2 PoCs
MEDIUM
Priority: 0.15
BB Relevance:
85/100
Published: 2024-03-10
Modified: 2026-11-10
First seen: 2026-11-10
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
None
I:
None
A:
High
Description
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
Weakness Classification (1)
Affected Software (17)
| Vendor | Product | Version |
|---|---|---|
| fedoraproject | fedora | 38 |
| fedoraproject | fedora | 39 |
| fedoraproject | fedora | 40 |
| libexpat_project | libexpat | < 2.6.2 |
| n/a | n/a | n/a |
| netapp | active_iq_unified_manager | - |
| netapp | h300s_firmware | - |
| netapp | h410c_firmware | - |
| netapp | h410s_firmware | - |
| netapp | h500s_firmware | - |
| netapp | h610c_firmware | - |
| netapp | h610s_firmware | - |
| netapp | h700s_firmware | - |
| netapp | oncommand_workflow_automation | - |
| netapp | ontap | 9 |
| netapp | ontap_tools | 10 |
| netapp | windows_host_utilities | - |
References & Advisories (13)
vendor-advisory
vendor-advisory
vendor-advisory
mailing-list