CVE-2024-6893
Published: 08 August 2024
Summary
CVE-2024-6893 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Journyx Journyx. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability CVE-2024-6893 is an XML external entity injection flaw (CWE-611) in the soap_cgi.pyc API handler. The component accepts SOAP requests whose XML bodies contain references to external entities, enabling unauthorized access to local resources and external systems.
An unauthenticated remote attacker can exploit the issue over the network to read arbitrary local files, conduct server-side request forgery, and exhaust web server resources through resource consumption. The flaw received a CVSS 3.1 score of 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Advisories describing the issue are available at https://korelogic.com/Resources/Advisories/KL-001-2024-010.txt and http://seclists.org/fulldisclosure/2024/Aug/8. The EPSS score reached a peak of 0.9384 with a current value of 0.9139.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-47882
Vulnerability details
The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.