PT-2018-13941 · Apache+2 · Apache Syncope+2

Published 2018-11-06 · Updated 2019-01-31 · CVE-2018-17186

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned.

Description The issue allows an administrator with workflow definition entitlements to use DTD (Document Type Definition) for malicious purposes. This can include reading files, writing files, and executing code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-17186

GHSA-QFJV-998W-Q48F

Affected Products

Apache Syncope

Org.Apache.Syncope:Syncope-Core

Syncope

References · 6

• https://osv.dev/vulnerability/GHSA-qfjv-998w-q48f · Vendor Advisory
• https://syncope.apache.org/security#CVE-2018-17186:_XXE_on_BPMN_definitions · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17186 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17186 · Vendor Advisory
• https://github.com/apache/syncope/commit/a0f35f45f8ca5c98853ae8477fb2db81a84709a · Note
• https://github.com/advisories/GHSA-qfjv-998w-q48f · Note