Arbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_pro
Priority MEDIUM 40CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-611 and the CVSS impact.
Summary
Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobster_pro prior to version 4.12.6-GA. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0047 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Lobster_pro (Lobster GmbH): 4.12.6-GA
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lobster GmbH | Lobster_pro | before 4.12.6-GA | 4.12.6-GA | Patch available | CNA |
- Lobster_pro VendorLobster GmbH Affected before 4.12.6-GA Fixed in 4.12.6-GA Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lobster-world:lobster_pro:*:*:*:*:*:*:*:* | before 4.12.6-ga | Vulnerable | Lobster-world |
- cpe:2.3:a:lobster-world:lobster_pro:*:*:*:*:*:*:*:* Versions before 4.12.6-ga Vulnerable ·Lobster-world
Remediation
- Fix · CNA Lobster_pro (Lobster GmbH) Fixed in 4.12.6-GA
Timeline
- 2026-10-02 Threatist record created from CVE-2024-13971
- 2026-10-03 Alias added: GHSA-cv2m-jfc5-xx45
References
Sources
- CVE-2024-13971 · CVE Program
- CVE-2024-13971 · NVD
- FIRST EPSS
- GHSA-cv2m-jfc5-xx45 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences