CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2019-9628
High (7.5). EPSS 2.1% chance of exploitation in the next 30 days.
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
Severity
- EPSS
- 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
- CWE
- CWE-755
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- opensuse:leap
- xmltooling_project:xmltooling
References
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.html
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.html
- https://bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912
- https://security.netapp.com/advisory/ntap-20190611-0003/
- https://shibboleth.net/community/advisories/secadv_20190311.txt