CVE-2010-3260

MEDIUM 6.4CVE-2010-3260 · Published 27/04/2011 · updated 16/06/2026

In short

CVE-2010-3260 is a MEDIUM (CVSS 6.4) vulnerability affecting forms (orbeon).
Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
forms orbeon	`= 1.5= 2.0= 2.1= 2.2= 2.5= 2.6= 2.7= 2.8= 3.0= 3.5= 3.6= 3.7.1= 3.8≤ 3.8.1`	No fix yet

Description

oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component in the XForms service in Orbeon Forms before 3.9 does not properly restrict DTDs in Ajax requests, which allows remote attackers to read arbitrary files or send HTTP requests to intranet servers via an entity declaration in conjunction with an entity reference, related to an "XML injection" issue.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free