GitHub Advisoryadvisory · Maven

GHSA-hjm9-576q-399p Remote Code Execution in esigate-core

CRITICAL Published 2018-12-21 Modified 2022-09-14 Official page ↗
Aliases
CVE-2018-1000854
Ecosystem
Maven
Packages
org.esigate:esigate-core
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2020-06-16

Affected packages

• Maven org.esigate:esigate-core: < 5.3 → fixed in 5.3

Description

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable via Use of another weakness in backend application to reflect ESI directives. This vulnerability appears to have been fixed in 5.3.

Related

Alias · CVE (1)

  • CVE-2018-1000854 esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References