CVE-2020-14029

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an XML External Entity attack that can be used to perform SSRF or read arbitrary local files.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

1.38% chance of exploitation in the next 30 days, 70th percentile

Published

2020-09-18

Updated

2024-08-04

Proof-of-concept exploits (1)

• DrunkenShells/Disclosures/tree/master/CVE-2020-14029-XXE-Ozeki%20SMS%20Gateway

References

• CVE Record
• NVD entry

Related

• CVE-2019-10092
• CVE-2019-11287
• CVE-2019-12401
• CVE-2019-12409
• CVE-2019-1332
• CVE-2019-14678