GitHub Advisoryadvisory · Maven

GHSA-xmvg-w4f9-99r7 XML External Entity (XXE) vulnerability in bw-calendar-engine

CRITICAL Published 2018-12-20 Modified 2022-09-14 Official page ↗
Aliases
CVE-2018-1000836
Ecosystem
Maven
Packages
org.bedework.caleng:bw-calendar-engine
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2020-06-16

Affected packages

• Maven org.bedework.caleng:bw-calendar-engine: <= 3.12.2 (no fix yet)

Description

bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the Middle or malicious server.

Related

Alias · CVE (1)

  • CVE-2018-1000836 bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References