CVE-2019-9757 describes an XML External Entity (XXE) vulnerability in LabKey Server 19.1.0, specifically impacting the visualization-exportImage.view and visualization-exportPDF.view endpoints. This high-severity vulnerability (CVSS 7.5) allows an unauthenticated attacker to read local files by submitting a specially crafted SVG containing an XXE payload. While there is no evidence of active exploitation or Metasploit modules, a Nuclei template exists, and the vulnerability has a high EPSS score indicating a significant likelihood of exploitation. Community discussion and media coverage are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
19.1.0CPE matchmatch criteria | cpe:2.3:a:labkey:labkey_server:19.1.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.