CVE-2024-8010

CVE-2024-8010 is an XML External Entity (XXE) vulnerability in a component that processes XML input from publishers without properly disabling external entity resolution. This flaw enables attackers to submit malicious XML payloads that exploit unescaped external entity references to read sensitive files from the affected product's file system or access HTTP resources available to the vulnerable server. The vulnerability carries a HIGH severity rating with a CVSS score of 7.5, reflecting a network-based attack vector requiring no authentication or user interaction, making it easily exploitable. The attack has high confidentiality impact as successful exploitation allows unauthorized access to sensitive files and resources, though integrity and availability are not affected. The vulnerability is currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and the Active Hot List, indicating active exploitation in the wild. However, the extremely low EPSS score of 0.000050000 suggests minimal community attention or publicly available exploit code at this time, despite the active exploitation status.