PT-2018-13941 · Apache+2 · Apache Syncope+2

Publicado 2018-11-06 · Atualizado 2019-01-31 · CVE-2018-17186

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned.

Description The issue allows an administrator with workflow definition entitlements to use DTD (Document Type Definition) for malicious purposes. This can include reading files, writing files, and executing code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2018-17186

GHSA-QFJV-998W-Q48F

Produtos afetados

Apache Syncope

Org.Apache.Syncope:Syncope-Core

Syncope

Referências · 6

• https://github.com/apache/syncope/commit/a0f35f45f8ca5c98853ae8477fb2db81a84709a · Nota
• https://github.com/advisories/GHSA-qfjv-998w-q48f · Nota
• https://osv.dev/vulnerability/GHSA-qfjv-998w-q48f · Aviso do Fabricante
• https://syncope.apache.org/security#CVE-2018-17186:_XXE_on_BPMN_definitions · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17186 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-17186 · Aviso do Fabricante