Lobster Pro
Monthly
Information disclosure in Lobster_pro affects version 4.12.12-LTS and potentially other releases prior to 25.1.3, where improper permission checks let an authenticated low-privilege user on an adjacent network reach HTTP endpoints reserved for administrators. The assessed impact is confidentiality-only, with high disclosure of both the vulnerable component and dependent systems but no integrity or availability effect; the CVSS 4.0 base score is 5.6, and no public exploit was identified at time of analysis. It is a medium-severity, moderate-priority issue (this_month) rather than an emergency.
Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobster_pro prior to version 4.12.6-GA. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
Information disclosure in Lobster_pro affects version 4.12.12-LTS and potentially other releases prior to 25.1.3, where improper permission checks let an authenticated low-privilege user on an adjacent network reach HTTP endpoints reserved for administrators. The assessed impact is confidentiality-only, with high disclosure of both the vulnerable component and dependent systems but no integrity or availability effect; the CVSS 4.0 base score is 5.6, and no public exploit was identified at time of analysis. It is a medium-severity, moderate-priority issue (this_month) rather than an emergency.
Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobster_pro prior to version 4.12.6-GA. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.