PT-2018-15228 · Apereo · Apereo Bedework

Viqueen · Published 2018-12-10 · Updated 2019-01-24 · CVE-2018-20000

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apereo Bedework bw-webdav versions prior to 4.0.3

Description The issue allows XXE attacks, which can be demonstrated by an invite-reply document that reads a local file. This is related to the files webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java.

Recommendations For versions prior to 4.0.3, update to version 4.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java files until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-20000

GHSA-5P52-J8PW-J7X5

Affected Products

Apereo Bedework

References · 7

• https://github.com/Bedework/bw-webdav/compare/bw-webdav-4.0.2...bw-webdav-4.0.3 · Patch
• https://github.com/Bedework/bw-webdav/pull/1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-20000 · Security Note
• https://osv.dev/vulnerability/GHSA-5p52-j8pw-j7x5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-20000 · Vendor Advisory
• https://github.com/Bedework/bw-webdav · Note
• https://github.com/advisories/GHSA-5p52-j8pw-j7x5 · Note