// For flags

CVE-2009-2473

Expat 2.0.1 - UTF-8 Character XML Parsing Remote Denial of Service

Severity Score

7.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

neon, en versiones anteriores a la 0.28.6, cuando se usa expat, no detecta adecuadamente la recursividad en la expansión de una entidad, esto permite a atacantes dependientes del contexto provocar una denegación de servicio (consumo de la memoria y CPU), mediante un documento XML manipulado que contiene un gran número de referencias anidadas a entidades, una cuestión similar a CVE-2003-1564.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2009-07-15 CVE Reserved
  • 2009-08-21 CVE Published
  • 2009-11-12 First Exploit
  • 2024-08-07 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-399: Resource Management Errors
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Webdav
Search vendor "Webdav"
 Neon
Search vendor "Webdav" for product "Neon"
 0.28.6
Search vendor "Webdav" for product "Neon" and version "0.28.6"
-
Affected