CyberRota Analysis
AI-GeneratedThe vulnerability affects the Lutece Core XSL export management module in Java versions up to 7.1.7, allowing authenticated administrators to execute arbitrary code remotely. The lack of secure processing mode in XML/XSLT configuration enables attackers with admin privileges to upload malicious XSL stylesheets, compromising server integrity during user export operations. Organizations utilizing this module should prioritize immediate remediation to mitigate the risk of exploitation.
Original NVD Description
A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode (FEATURE_SECURE_PROCESSING), allowing Java extension functions to be executed from malicious XSL stylesheets. An attacker with administrator privileges can upload a manipulated XSL transformation file and trigger its execution during user export operations, resulting in the execution of arbitrary code on the server.