GitHub Advisoryadvisory · Maven

GHSA-77hp-pfxw-4w63 XML External Entity (XXE) vulnerability in codelibs fess

CRITICAL Published 2018-12-20 Modified 2022-09-14 Official page ↗
Aliases
CVE-2018-1000822
Ecosystem
Maven
Packages
org.codelibs.fess:fess
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2020-06-16

Affected packages

• Maven org.codelibs.fess:fess: < 12.3.2 → fixed in 12.3.2

Description

codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via specially crafted GSA XML files. This vulnerability appears to have been fixed in after commit faa265b.

Related

Alias · CVE (1)

  • CVE-2018-1000822 codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References