CVE-2024-13971 — Arbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_pro

CVE-2024-13971

Arbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_pro PUBLISHED

Description (CNA)

Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobster_pro prior to version 4.12.6-GA. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.

Affected (CNA)

Vendor / product	Versions
Lobster GmbH / Lobster_pro	affected 0 before 4.12.6-GA; unaffected 4.12.6-GA

CWE

CWE-611

References

https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-005/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2026/May/1