← back
CVE-2017-9355

CVE-2017-9355

EPSS 26.9%
XML external entity (XXE) vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted XSPF playlist file.
Affected products
n/a · n/a
public PoCs found — 3
cve_referencepacketstormsecurity.com/files/142795/Subsonic-6.1.1-XML-External-Entity-Attack.htmlunverifiedcve_referencewww.exploit-db.com/exploits/42119/unverifiedexploitdbwww.exploit-db.com/exploits/42119unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://hyp3rlinx.altervista.org/advisories/SUBSONIC-XML-EXTERNAL-ENITITY.txthttp://packetstormsecurity.com/files/142795/Subsonic-6.1.1-XML-External-Entity-Attack.htmlhttps://www.exploit-db.com/exploits/42119/