CVE-2012-6685

moderate-risk

Published 2020-02-19

Nokogiri before 1.5.4 is vulnerable to XXE attacks

Do I need to act?

0.32% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Nokogiri

Cloudforms Management Engine

Openshift

Openstack

Openstack Foreman

Satellite

Subscription Asset Manager

Enterprise Mrg

Redhat Nokogiri

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1178970

Exploit https://github.com/sparklemotion/nokogiri/issues/693

Release Notes https://nokogiri.org/CHANGELOG.html#154-2012-06-12

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1178970

Exploit https://github.com/sparklemotion/nokogiri/issues/693

Release Notes https://nokogiri.org/CHANGELOG.html#154-2012-06-12

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 1/34 · Minimal

Exposure 15/34 · Moderate