CVE-2019-14277

CVE-2019-14277 describes an unauthenticated blind XML injection and XXE vulnerability within the resetPassword functionality of Axway SecureTransport versions 5.x through 5.3 (or 5.5 with specific API configurations). This critical flaw, with a CVSS score of 9.8, allows for local file disclosure, denial of service, or URI invocation attacks, potentially leading to server-side request forgery and remote code execution. Despite vendor dispute, the vulnerability is easily exploitable over the network with low attack complexity and no user interaction required. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.