漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
OpenRemote has XXE in Velbus Asset Import
Vulnerability Description
OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses attacker-controlled XML without explicit XXE hardening. An authenticated user who can call the import endpoint may trigger XML external entity processing, which can lead to server-side file disclosure and SSRF. The target file must be less than 1023 characters. Version 1.22.0 fixes the issue.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Vulnerability Title
OpenRemote 代码问题漏洞
Vulnerability Description
OpenRemote是OpenRemote开源的一个开源物联网平台。 OpenRemote 1.22.0之前版本存在代码问题漏洞，该漏洞源于Velbus资产导入路径解析攻击者控制的XML时未进行显式XML外部实体加固，可能导致经过身份验证的用户触发XML外部实体处理，造成服务器端文件泄露和服务端请求伪造。
CVSS Information
N/A
Vulnerability Type
N/A