PT-2018-13068 · Unknown · Javamelody

Huanying + 1 · Publicado 2018-09-26 · Atualizado 2018-11-29 · CVE-2018-15531

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JavaMelody versions prior to 1.74.0

Description The issue concerns an XXE (XML External Entity) vulnerability. It is related to the parseSoapMethodName function in the PayloadNameRequestWrapper.java file.

Recommendations For versions prior to 1.74.0, update to version 1.74.0 or later to resolve the issue.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2018-15531

GHSA-6FVX-R7HX-3VH6

Produtos afetados

Javamelody

Referências · 9

• https://github.com/javamelody/javamelody/wiki/ReleaseNotes · Aviso do Fabricante
• https://github.com/javamelody/javamelody/commit/ef111822562d0b9365bd3e671a75b65bd0613353 · Aviso do Fabricante
• https://github.com/javamelody/javamelody · Nota
• http://openwall.com/lists/oss-security/2018/09/25/3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-15531 · Nota de Segurança
• https://jenkins.io/security/advisory/2018-09-25 · Nota
• https://osv.dev/vulnerability/CVE-2018-15531 · Aviso do Fabricante
• https://github.com/advisories/GHSA-6fvx-r7hx-3vh6 · Nota
• https://osv.dev/vulnerability/GHSA-6fvx-r7hx-3vh6 · Aviso do Fabricante