Summary
Multiple vulnerabilities in the third-party component fast-xml-parser affect the Device Manager Extension in Sentio Creator. The extension is maintained and updated independently from SICK Sentio Creator, but successful exploitation of these vulnerabilities could impact the security of the Sentio Creator. SICK strongly recommends upgrading the extension to remediate the identified issues.
Vulnerabilities 3
-
Critical 9.3
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replace…
-
High 7.5
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With …
-
Low 2.7
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:…
Revision history
-
#1
Initial version
References
-
SICK PSIRT Security Advisories
https://www.sick.com/psirt
-
SICK Operating Guidelines
https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf
-
ICS-CERT recommended practices on Industrial Security
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
CVSS v3.1 Calculator
https://www.first.org/cvss/calculator/3.1