CVE-2024-53675
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- EPSS probability
- 83.63%
- CWE
- CWE-91
- Published
- 2024-11-26
- Last modified
- 2026-03-13
Affected products
- Hewlett Packard Enterprise (HPE) HPE Insight Remote Support
Weakness type
Related vulnerabilities
- CVE-2026-83618 — xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
- CVE-2026-83617 — xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
- CVE-2026-83616 — xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
- CVE-2026-83609 — xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
- CVE-2026-83608 — xmldom: DocType `name` Injection Bypasses requireWellFormed
- CVE-2026-83607 — xmldom: Element name injection via createElement() bypasses requireWellFormed
- CVE-2026-83605 — xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
- CVE-2026-48590 — Element and Attribute Names Injected Verbatim into XML Output in xml_builder