Mura CMS 'tasks/feed/readRSS.cfm' XML External Entity Injection Vulnerability

Bugtraq ID:	101603
Class:	Input Validation Error
CVE:	CVE-2017-15639
Remote:	Yes
Local:	No
Published:	Oct 19 2017 12:00AM
Updated:	Dec 19 2017 10:36PM
Credit:	Anthony Cole
Vulnerable:	Blue River Interactive Group Mura CMS 5.2.2809 Blue River Interactive Group Mura CMS 5.2.2085 Blue River Interactive Group Mura CMS 5.1.498 Blue River Interactive Group Mura CMS 6.1 Blue River Interactive Group Mura CMS 6.0 Blue River Interactive Group Mura CMS 5.2 Blue River Interactive Group Mura CMS 5.1 Blue River Interactive Group Mura CMS 5.0
Not Vulnerable:	Blue River Interactive Group Mura CMS 6.2

Mura CMS 'tasks/feed/readRSS.cfm' XML External Entity Injection Vulnerability

Mura CMS is prone to an XML External Entity injection vulnerability.

Attackers can exploit this issue to gain access to sensitive information or cause denial-of-service condition.

Mura CMS 6.1 and prior versions are vulnerable.

Mura CMS 'tasks/feed/readRSS.cfm' XML External Entity Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Mura CMS 'tasks/feed/readRSS.cfm' XML External Entity Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Mura CMS 'tasks/feed/readRSS.cfm' XML External Entity Injection Vulnerability

References:

• Critical Security Update for Mura CMS: Version 6.1 and Earlier (getmura.com)
  
• Mura Home Page (Blue River Interactive Group)