PT-2018-11570

CVE-2018-1307

Publicado

2018-02-09

Atualizado

2018-10-19

Descrição por

CVSS 3.1

8.1

Alta

MétricasAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache jUDDI versions 3.2 through 3.3.4

Description The issue concerns a lack of protection against entity expansion and DTD type of attacks when using the WADL2Java or WSDL2Java classes to parse local or remote XML documents. These classes mediate the data structures into UDDI data structures.

Recommendations For Apache jUDDI versions 3.2 through 3.3.4, update to version 3.3.5 to resolve the issue.

Explorabilidade

Correção

Impactos

Pesquisadores

Alex Oree

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-611: Improper Restriction of XML External Entity Reference

Identificadores relacionados

CVE-2018-1307