CVE-2024-29010 in GMS

Summary

by MITRE • 05/01/2024

The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the disclosure of sensitive information.

This issue affects GMS: 9.3.4 and earlier versions.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Reservation: 03/14/2024
• Disclosure: 05/01/2024
• Moderation: accepted
• Entry: VDB-262543
• CPE: ready
• CWE: CWE-611 (confirmed)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00621
• KEV: no
• Activities: very low
• Sector: Agriculture, Hospital, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2024-29010
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-29010
• CVE Details: https://www.cvedetails.com/cve/CVE-2024-29010/