Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Direct Web Remoting 信息泄露漏洞
Vulnerability Description
Direct Web Remoting（DWR）是一套用于改善Web页面与Java类交互的远程服务器端Ajax开源框架，它可帮助开发人员开发包含AJAX技术的网站，并允许浏览器里的代码使用运行在Web服务器上的JAVA函数。 DWR的‘DOMConverter’、‘JDOMConverter’、‘DOM4JConverter’和‘XOMConverter’函数中存在安全漏洞。远程攻击者可借助特制的XML文档的DOM数据利用该漏洞读取任意文件。以下版本受到影响：DWR 2.0.10及之前版本，3.0.RC1
CVSS Information
N/A
Vulnerability Type
N/A