CVE-2017-18197 mxGraph vulnerable to XXE attacks
CriticalCVSS 9.8
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm mxgraph(npm) | < 3.7.6 | 3.7.6 |
| debian/libjgraphx-java(Debian:12) | < 2.1.0.7-2 | 2.1.0.7-2 |
| debian/libjgraphx-java(Debian:13) | < 2.1.0.7-2 | 2.1.0.7-2 |
| debian/libjgraphx-java(Debian:14) | < 2.1.0.7-2 | 2.1.0.7-2 |
| jgraph mxgraph | <= 3.7.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com exploit third-party-advisory
- [debian-lts-announce] 20180304 [SECURITY] [DLA 1299-1] libjgraphx-java security update mailing-list third-party-advisory
- github.com patch
- github.com
- Debian Security Tracker CVE-2017-18197 vendor-advisory
- bugs.debian.org issue-tracking