PT-2018-10809 · Apache · Apache Cayenne
Andrus Adamchik
·
Published
2018-08-22
·
Updated
2022-05-14
·
CVE-2018-11758
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Cayenne versions 3.1 through 3.1.2
Apache Cayenne versions 3.2.M1
Apache Cayenne versions 4.0.B1 through 4.0.RC1
Apache Cayenne versions 4.0.M2 through 4.0.M5
Apache Cayenne version 4.1.M1
Description
The issue affects CayenneModeler, a desktop GUI tool for editing Cayenne ORM models stored as XML files. An attacker can trick a user into opening a malicious XML file, allowing the attacker to transfer files from the local machine to a remote machine. This is caused by the XML parser processing XML External Entity (XXE) declarations in XML files.
Recommendations
For Apache Cayenne versions 3.1 through 3.1.2, update to a version where XXE processing is disabled in all operations that require XML parsing.
For Apache Cayenne versions 3.2.M1, update to a version where XXE processing is disabled in all operations that require XML parsing.
For Apache Cayenne versions 4.0.B1 through 4.0.RC1, update to a version where XXE processing is disabled in all operations that require XML parsing.
For Apache Cayenne versions 4.0.M2 through 4.0.M5, update to a version where XXE processing is disabled in all operations that require XML parsing.
For Apache Cayenne version 4.1.M1, update to a version where XXE processing is disabled in all operations that require XML parsing.
Fix
XXE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Cayenne