CVE-2024-35532

Summary

CVE-2024-35532 is an XML External Entity (XXE) injection vulnerability affecting Intersec Geosafe-ea versions 2022.12, 2022.13, and 2022.14. This issue grants attackers the ability to read arbitrary files on the targeted system, launch Server Side Request Forgery (SSRF) attacks, and cause a Denial of Service (DoS), exploiting the targeted application's handling of XML data. Attackers can potentially gain privileged access and execute unintended functionalities by manipulating the XML input. Organizations using these versions of Intersec Geosafe-ea are advised to apply patches or workarounds to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.