Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference
Vulnerability Description
A weakness has been identified in bestfeng oa_git_free up to 9.5. This affects the function updateWriteBack of the file yimioa-oa9.5\server\c-flow\src\main\java\com\cloudweb\oa\controller\WorkflowPredefineController.java. This manipulation of the argument writeProp causes xml external entity reference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Vulnerability Title
oa_git_free 代码问题漏洞
Vulnerability Description
bestfeng oa_git_free（行云流程引擎）是中国云网OA（bestfeng）公司的一个企业自动化流程平台。 oa_git_free 9.5及之前版本存在代码问题漏洞，该漏洞源于文件yimioa-oa9.5serverc-flowsrcmainjavacomcloudweboacontrollerWorkflowPredefineController.java中参数writeProp的错误操作，可能导致XML外部实体引用。
CVSS Information
N/A
Vulnerability Type
N/A