Description
LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- LumisXP <10.0.0 - Blind XML External Entity Attack http/cves/2021/CVE-2021-27931.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.