Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback ID of the configured identity source. A remote attacker can send a request crafted with an XXE payload to invoke a malicious DTD hosted on a system that they control. This results in reading local files that the application has access to.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Morpheus Data Morpheus 代码问题漏洞
Vulnerability Description
Morpheus Data Morpheus是美国Morpheus Data公司的一个强大的自助服务引擎。可提供企业敏捷性、控制力和效率。 Morpheus Data Morpheus 5.2.16 版本和 5.4.4 版本之前的 5.4.x 版本存在安全漏洞，该漏洞源于发现了一个 XXE 问题。远程攻击者在知道配置的身份源的唯一 SAML 回调 ID 的情况下，可以发送一个带有 XXE 有效负载的请求，以调用托管在他们控制的系统上的恶意 DTD。
CVSS Information
N/A
Vulnerability Type
N/A