PUBLISHED
2025-11-26 23:15
MODIFIED
2025-11-26 23:15
EPSS (Prob. Exploit)
0.18%
Top 92.7%
> DESCRIPTION
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted.
An attacker can remove the signature from the XML document to make it pass the verification check.
XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should return an error message. The affected versions return true when attempting to validate an XML file that contains no signatures.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-347: Improper Verification of Cryptographic Signature - The product does not verify, or incorrectly verifies, the cryptographic signature for data.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
XML-Sig prior to 0.68 for Perl improperly validates XML without signatures
> HISTORIQUE DES MODIFICATIONS
Première apparition
26/11/2025 23:15
Source: NVD
📊
ENRICHISSEMENT
19/01/2026 17:37
CVEPROJECT
Champ modifié: CVE Project
📊
ENRICHISSEMENT
01/12/2025 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-347: Improper Verification of Cryptographic Signature - The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Total des modifications: 2
Dernière mise à jour: 9 months ago