What is the CVSS score of CVE-2015-3451?

CVE-2015-3451 has a CVSS 2.0 base score of 5.0 (Medium). CVSS vector: AV:N/AC:L/Au:N/C:P/I:N/A:N. EPSS exploitation probability: 5.0%.

Xml Libxml CVE-2015-3451

MEDIUM

Improper Restriction of XML External Entity Reference (CWE-611)

2015-05-12 cve@mitre.org

XXE Xml Libxml Ubuntu Linux Debian Linux Fedora Opensuse

5.0

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:L/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:P/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

May 12, 2015 - 19:59 cve.org

MEDIUM 5.0

DescriptionCVE.org

The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.

AnalysisAI

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function. Affected products include: Xml-Libxml Project Xml-Libxml, Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Opensuse. Version information: before 2.0119.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Disable external entity processing in XML parsers, use JSON instead of XML where possible.