CVE-2025-34142 is a CWE-611 XML External Entity (XXE) vulnerability in the legacy ETQ Reliance CG platform. It affects the SAML authentication handler at the `/resources/sessions/sso` endpoint, where XML input is parsed without disabling external entity resolution. This flaw allows attackers to craft malicious SAML responses that invoke external entity references, potentially enabling unauthorized file disclosure or SSRF attacks. The vendor fixed the vulnerability by disabling external entity processing in the affected XML parser starting with versions SE.2025.1 and 2025.1.2.

Exploitation of this vulnerability could allow an unauthenticated attacker to read sensitive files on the server or perform server-side request forgery (SSRF) via crafted SAML responses. This may lead to information disclosure and indirect network access from the vulnerable server. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality and integrity.

A fix is available and has been implemented by ETQ in versions SE.2025.1 and 2025.1.2, which disable external entity processing in the XML parser used by the SAML authentication handler. Users of ETQ Reliance CG (legacy) should upgrade to these or later versions to remediate the vulnerability. No additional mitigation guidance is provided or required beyond applying the official fix.