PT-2018-15228 · Apereo · Apereo Bedework

Viqueen · Publicado 2018-12-10 · Atualizado 2019-01-24 · CVE-2018-20000

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apereo Bedework bw-webdav versions prior to 4.0.3

Description The issue allows XXE attacks, which can be demonstrated by an invite-reply document that reads a local file. This is related to the files webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java.

Recommendations For versions prior to 4.0.3, update to version 4.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java files until a patch is available.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2018-20000

GHSA-5P52-J8PW-J7X5

Produtos afetados

Apereo Bedework

Referências · 7

• https://github.com/Bedework/bw-webdav/compare/bw-webdav-4.0.2...bw-webdav-4.0.3 · Correção
• https://github.com/Bedework/bw-webdav/pull/1 · Correção
• https://github.com/Bedework/bw-webdav · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-20000 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-5p52-j8pw-j7x5 · Aviso do Fabricante
• https://github.com/advisories/GHSA-5p52-j8pw-j7x5 · Nota
• https://osv.dev/vulnerability/CVE-2018-20000 · Aviso do Fabricante