CVE-2017-7545 XML External Entity Reference in jbpmmigration
MediumCVSS 6.5
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXternal Entity (XXE) attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jbpm.jbpm5/jbpmmigration(Maven) | <= 0.15 | No fix listed |
| org.jbpm.jbpm5/jbpmmigration(Maven) | = 0.11 | No fix listed |
| org.jbpm.jbpm5/jbpmmigration(Maven) | = 0.12 | No fix listed |
| org.jbpm.jbpm5/jbpmmigration(Maven) | = 0.13 | No fix listed |
| org.jbpm.jbpm5/jbpmmigration(Maven) | = 0.14 | No fix listed |
| org.jbpm.jbpm5/jbpmmigration(Maven) | = 0.15 | No fix listed |
| redhat decision manager | = 7.0 | No fix listed |
| redhat jboss bpm suite | = 6.4 | No fix listed |
| redhat jbpm | = 6.5 | No fix listed |
| KIE jbpm-designer | = 6.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- RHSA-2017:3354 vendor-advisory
- RHSA-2017:3355 vendor-advisory
- bugzilla.redhat.com issue-tracking patch vendor-advisory
- bugzilla.redhat.com
- github.com
- github.com product
- 102179 third-party-advisory vdb-entry