What is CVE-2019-9761?

CVE-2019-9761 is a high-severity vulnerability in Phpshe, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.5/10. Published 2019-03-14.

How severe is CVE-2019-9761?

High severity. CVSS v3 base score is 7.5 out of 10.

XXE in Phpshe

CVE-2019-9761

An XXE issue was discovered in PHPSHE 1.7, which can be used to read any file in the system or scan the internal network without authentication. This occurs because of the call to wechat_getxml in include/plugin/payment/wechat/notify_url.php.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.017 (75.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Phpshe — versions 1.7
N/a — versions n/a

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2019-9761?: CVE-2019-9761 is a high-severity vulnerability in Phpshe, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.5/10. Published 2019-03-14.
How severe is CVE-2019-9761?: High severity. CVSS v3 base score is 7.5 out of 10.