PT-2018-11570

CVE-2018-1307

Published

2018-02-09

Updated

2018-10-19

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache jUDDI versions 3.2 through 3.3.4

Description The issue concerns a lack of protection against entity expansion and DTD type of attacks when using the WADL2Java or WSDL2Java classes to parse local or remote XML documents. These classes mediate the data structures into UDDI data structures.

Recommendations For Apache jUDDI versions 3.2 through 3.3.4, update to version 3.3.5 to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Alex Oree

Vendors

Affected products

Weakness enumeration

CWE-611: Improper Restriction of XML External Entity Reference

Related identifiers

CVE-2018-1307