GitHub Advisoryadvisory · Maven

GHSA-6xq8-pvg4-3mf3 Eclipse RDF4j vulnerable to XML External Entity

CRITICAL Published 2018-10-19 Modified 2025-10-15 Official page ↗
Aliases
CVE-2018-1000644
Ecosystem
Maven
Packages
org.eclipse.rdf4j:rdf4j-runtime
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2020-06-16

Affected packages

• Maven org.eclipse.rdf4j:rdf4j-runtime: < 2.4.0 → fixed in 2.4.0

Description

Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.

Related

Alias · CVE (1)

  • CVE-2018-1000644 Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References