InterviewSolution
Saved Bookmarks
InterviewSolution
| 1. |
Is Xstream Xxe Vulnerable (cve-2016-3674)? |
|
Answer» XStream does not contain an own XML PARSER, therefore it DEPENDS on the parser selected with the HierarchicalStreamDriver if the current XStream instance is XXE vulnerable at deserialization time. However, XStream tries to deactivate the PROCESSING of external entities by DEFAULT. Status for the different supported XML parsers. XStream does not contain an own XML parser, therefore it depends on the parser selected with the HierarchicalStreamDriver if the current XStream instance is XXE vulnerable at deserialization time. However, XStream tries to deactivate the processing of external entities by default. Status for the different supported XML parsers. |
|