Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2025-34142: ETQ Reliance CG platform exposes sensitive data through XML input
CVE-2025-34142 · published 1 year ago
Summary
A security flaw in ETQ Reliance's legacy CG platform lets hackers access sensitive files or trick the system into making unauthorized requests. This affects the `/resources/sessions/sso` endpoint, which handles XML input without proper security checks. To fix, update to version SE.2025.1 or 2025.1.2.
Original advisory text
An XML External Entity (XXE) injection vulnerability exists in ETQ Reliance on the CG (legacy) platform within the `/resources/sessions/sso` endpoint. The SAML authentication handler processes XML ...
An XML External Entity (XXE) injection vulnerability exists in ETQ Reliance on the CG (legacy) platform within the `/resources/sessions/sso` endpoint. The SAML authentication handler processes XML input without disabling external entity resolution, allowing crafted SAML responses to invoke external entity references. This could enable attackers to retrieve sensitive files or perform server-side request forgery (SSRF). The issue was addressed by disabling external entity processing for the affected XML parser in versions SE.2025.1 and 2025.1.2.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-611XML External Entity (XXE)
Timeline
Published22 Jul 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-34142 · NVD
Track software like this
Free during beta