CVE-2024-28757: High severity IBM Cognos Dashboards on Cloud Pak for Data vulnerability
libexpat could allow a remote attacker to obtain sensitive information, caused by improper handling of XML external entity (XXE) declarations by the XMLExternalEntityParserCreate function. By using a specially crafted XML content, a remote attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
Other sources
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XMLExternalEntityParserCreate).
— Ubuntu
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28757?
CVE-2024-28757 is classified as a medium severity vulnerability due to its potential to expose sensitive information.
How do I fix CVE-2024-28757?
To mitigate CVE-2024-28757, upgrade to libexpat version 2.6.2-1 on Debian, 2.4.7-1ubuntu0.3 on Ubuntu Jammy, or 2.6.2 on Red Hat.
What types of attacks can exploit CVE-2024-28757?
CVE-2024-28757 can be exploited through specially crafted XML content leveraging XML external entity (XXE) declarations.
Which software versions are affected by CVE-2024-28757?
CVE-2024-28757 affects libexpat versions up to 2.2.6-2+deb10u7 on Debian and various versions noted for Ubuntu and Red Hat.
Is CVE-2024-28757 a local or remote vulnerability?
CVE-2024-28757 is a remote vulnerability that requires an attacker to send specially crafted XML content to the target system.