Re: Possible issue: XXE (Xml eXternal Entity) attack

Rick Jelliffe wrote,
> > * Unauthorized access to data stored as XML files on the parsing
> >   system file system (of course the attacker still needs a way to
> >   get these data back)
>
> Err, yes: this is a bit too vague to be credible isn't it.

I sketched a scenario here,

  http://lists.xml.org/archives/xml-dev/200206/msg00247.html

(see towards the middle, "unexpected information disclosure"). Maybe 
still a bit vague, and highly dependent on the functionality of the 
receiving application ... but I think the possibility is credible 
enough.

Cheers,


Miles