GitHub Advisoryadvisory · Maven

GHSA-qfjv-998w-q48f Improper Restriction of XML External Entity Reference in org.apache.syncope:syncope-core

HIGH Published 2018-11-06 Modified 2024-03-04 Official page ↗
Aliases
CVE-2018-17186
Ecosystem
Maven
Packages
org.apache.syncope:syncope-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2020-06-16

Affected packages

• Maven org.apache.syncope:syncope-core: < 2.0.11 → fixed in 2.0.11 • Maven org.apache.syncope:syncope-core: >= 2.1.0, < 2.1.2 → fixed in 2.1.2

Description

An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.

Related

Alias · CVE (1)

  • CVE-2018-17186 An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read,… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References