PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-13971 Lobster World CVE debrief

CVE-2024-13971 is a high-severity weakness in Lobster_pro’s XML parser functionality that affects versions before 4.12.6-GA. According to the supplied NVD record and referenced advisory material, an unauthenticated attacker can use the issue to read files on the application server, access adjacent network shares, and trigger HTTP GET requests to arbitrary services.

Vendor
Lobster World
Product
Lobster Pro
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-30
Original CVE updated
2026-05-17
Advisory published
2026-04-30
Advisory updated
2026-05-17

Who should care

Administrators and security teams responsible for Lobster_pro deployments, especially systems that expose XML parsing features or have access to sensitive local files, internal shares, or outbound network paths.

Technical summary

The supplied record maps this issue to CWE-611 and describes an unauthenticated attack surface in Lobster_pro prior to 4.12.6-GA. NVD lists the vulnerable CPE as lobster-world:lobster_pro with the version range ending before 4.12.6-GA. The stated impact includes read access to server files and adjacent network shares, plus the ability to issue HTTP GET requests to arbitrary services, which indicates server-side request capability and data exposure risk.

Defensive priority

High. The combination of unauthenticated access, file disclosure, and potential internal service interaction makes this a priority for exposed Lobster_pro instances.

Recommended defensive actions

  • Upgrade Lobster_pro to 4.12.6-GA or later.
  • Review whether XML parser functionality is exposed to untrusted input and restrict access where possible.
  • Audit application and host permissions to reduce readable file and share exposure.
  • Limit outbound network access from the application server to only required destinations.
  • Monitor logs for unusual file access, internal share access, or unexpected HTTP requests originating from Lobster_pro.
  • Follow vendor or advisory guidance linked in the NVD references and verify all affected installations are remediated.

Evidence notes

All technical claims are taken from the supplied NVD record and its referenced advisory links. The record publishedAt and modifiedAt provided in the timeline are 2026-04-30 and 2026-05-17, respectively, and those dates are used here as the CVE timing context. The vulnerability is described as affecting Lobster_pro prior to 4.12.6-GA and is associated with CWE-611. The CVE identifier contains 2024, but the supplied timeline places publication in 2026; this debrief follows the provided timeline fields rather than the identifier year.

Official resources

CVE published in the supplied timeline on 2026-04-30 and last modified on 2026-05-17. NVD marks the record as Modified and references a Schutzwerk advisory plus a full disclosure post as supporting material.