yworks yEd Graph Editor – XML External Entity injection

DATE

07.10.2020

Affected Vendor

yworks

Affected Product

yEd Graph Editor – https://www.yworks.com

Vulnerable version

3.20

Fixed version

3.20.1

CVSS

2.9 Low CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

Recommendations

Update to yworks yEd Graph Editor version 3.20.1

Vulnerability details

The yEd Graph Editor application has XML External Entities enabled. It is possible to conduct XML External Entities injection attack and potentially exfiltrate files on the victim workstation via malicious XML file such as GraphML document.

CVE

CVE-2020-25215

Credits

Dawid Czarnecki

References

Do you think the security of your data might be lacking? Let's find the best approach together.
Once you contact us, we will ask you about the project you want to secure.

NEED A CONSULTATION?

Contact Us