Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc.
Weakness
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Typecho | Typecho | 1.2.1 (including) | 1.2.1 (including) |
| Typecho | Typecho | 1.2.1-rc (including) | 1.2.1-rc (including) |
| Typecho | Typecho | 1.2.1-rc2 (including) | 1.2.1-rc2 (including) |