CVE-2025-31497

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-31497", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-03-28T13:36:51.299Z", "datePublished": "2025-04-15T20:00:17.738Z", "dateUpdated": "2025-04-15T20:26:07.727Z"}, "containers": {"cna": {"title": "TEIGarage XML External Entity (XXE) Injection in Document Conversion Service", "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "lang": "en", "description": "CWE-611: Improper Restriction of XML External Entity Reference", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/TEIC/TEIGarage/security/advisories/GHSA-w2hq-3cjc-2x55", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/TEIC/TEIGarage/security/advisories/GHSA-w2hq-3cjc-2x55"}], "affected": [{"vendor": "TEIC", "product": "TEIGarage", "versions": [{"version": "< 1.2.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-04-15T20:00:17.738Z"}, "descriptions": [{"lang": "en", "value": "TEIGarage is a webservice and RESTful service to transform, convert and validate various formats, focussing on the TEI format. The Document Conversion Service contains a critical XML External Entity (XXE) Injection vulnerability in its document conversion functionality. The service processes XML files during the conversion process but fails to disable external entity processing, allowing an attacker to read arbitrary files from the server's filesystem. This vulnerability could allow attackers to read sensitive files from the server's filesystem, potentially exposing configuration files, credentials, or other confidential information. Additionally, depending on the server configuration, this could potentially be used to perform server-side request forgery (SSRF) attacks by making the server connect to internal services. This issue is patched in version 1.2.4. A workaround for this vulnerability includes disabling external entity processing in the XML parser by setting the appropriate security features (e.g., XMLConstants.FEATURE_SECURE_PROCESSING)."}], "source": {"advisory": "GHSA-w2hq-3cjc-2x55", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-15T20:23:24.238912Z", "id": "CVE-2025-31497", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-15T20:26:07.727Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-31497", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-15T20:23:24.238912Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-15T20:23:29.047Z"}}], "cna": {"title": "TEIGarage XML External Entity (XXE) Injection in Document Conversion Service", "source": {"advisory": "GHSA-w2hq-3cjc-2x55", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "TEIC", "product": "TEIGarage", "versions": [{"status": "affected", "version": "< 1.2.4"}]}], "references": [{"url": "https://github.com/TEIC/TEIGarage/security/advisories/GHSA-w2hq-3cjc-2x55", "name": "https://github.com/TEIC/TEIGarage/security/advisories/GHSA-w2hq-3cjc-2x55", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "TEIGarage is a webservice and RESTful service to transform, convert and validate various formats, focussing on the TEI format. The Document Conversion Service contains a critical XML External Entity (XXE) Injection vulnerability in its document conversion functionality. The service processes XML files during the conversion process but fails to disable external entity processing, allowing an attacker to read arbitrary files from the server's filesystem. This vulnerability could allow attackers to read sensitive files from the server's filesystem, potentially exposing configuration files, credentials, or other confidential information. Additionally, depending on the server configuration, this could potentially be used to perform server-side request forgery (SSRF) attacks by making the server connect to internal services. This issue is patched in version 1.2.4. A workaround for this vulnerability includes disabling external entity processing in the XML parser by setting the appropriate security features (e.g., XMLConstants.FEATURE_SECURE_PROCESSING)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-611", "description": "CWE-611: Improper Restriction of XML External Entity Reference"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-04-15T20:00:17.738Z"}}}, "cveMetadata": {"cveId": "CVE-2025-31497", "state": "PUBLISHED", "dateUpdated": "2025-04-15T20:26:07.727Z", "dateReserved": "2025-03-28T13:36:51.299Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-04-15T20:00:17.738Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "TEIGarage", "vendor": "TEIC", "versions": [{"status": "affected", "version": "< 1.2.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TEIGarage is a webservice and RESTful service to transform, convert and validate various formats, focussing on the TEI format. The Document Conversion Service contains a critical XML External Entity (XXE) Injection vulnerability in its document conversion functionality. The service processes XML files during the conversion process but fails to disable external entity processing, allowing an attacker to read arbitrary files from the server's filesystem. This vulnerability could allow attackers to read sensitive files from the server's filesystem, potentially exposing configuration files, credentials, or other confidential information. Additionally, depending on the server configuration, this could potentially be used to perform server-side request forgery (SSRF) attacks by making the server connect to internal services. This issue is patched in version 1.2.4. A workaround for this vulnerability includes disabling external entity processing in the XML parser by setting the appropriate security features (e.g., XMLConstants.FEATURE_SECURE_PROCESSING)."}, {"lang": "es", "value": "TEIGarage es un servicio web y RESTful para transformar, convertir y validar diversos formatos, centr\u00e1ndose en el formato TEI. El Servicio de Conversi\u00f3n de Documentos contiene una vulnerabilidad cr\u00edtica de inyecci\u00f3n de entidades externas XML (XXE) en su funcionalidad de conversi\u00f3n. El servicio procesa archivos XML durante el proceso de conversi\u00f3n, pero no deshabilita el procesamiento de entidades externas, lo que permite a un atacante leer archivos arbitrarios del sistema de archivos del servidor. Esta vulnerabilidad podr\u00eda permitir a los atacantes leer archivos confidenciales del sistema de archivos del servidor, exponiendo potencialmente archivos de configuraci\u00f3n, credenciales u otra informaci\u00f3n confidencial. Adem\u00e1s, dependiendo de la configuraci\u00f3n del servidor, esto podr\u00eda utilizarse para realizar ataques de server-side request forgery (SSRF) al hacer que el servidor se conecte a servicios internos. Este problema est\u00e1 corregido en la versi\u00f3n 1.2.4. Un workaround para esta vulnerabilidad consiste en deshabilitar el procesamiento de entidades externas en el analizador XML mediante la configuraci\u00f3n de las funciones de seguridad adecuadas (p. ej., XMLConstants.FEATURE_SECURE_PROCESSING)."}], "id": "CVE-2025-31497", "lastModified": "2026-06-17T09:10:30.247", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-31497", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-15T20:23:24.238912Z", "version": "2.0.3"}}]}, "published": "2025-04-15T20:15:39.270", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/TEIC/TEIGarage/security/advisories/GHSA-w2hq-3cjc-2x55"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}