CVE-2018-15531 JavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.
CriticalCVSS 9.8
EPSS 27.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| net.bull.javamelody/javamelody-core(Maven) | < 1.74.0 | 1.74.0 |
| net.bull.javamelody/javamelody-core(Maven) | = 1.10.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.11.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.11.1 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.12.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.13.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.14.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.15.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.16.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.16.1 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.17.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.18.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.19.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.20.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.21.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.22.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.23.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.25.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.26.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.27.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.28.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.29.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.29.1 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.30.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.31.0 | No fix listed |
Show 50 more
| Product | Affected versions | Fixed in |
|---|---|---|
| net.bull.javamelody/javamelody-core(Maven) | = 1.32.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.32.1 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.33.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.34.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.35.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.36.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.37.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.38.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.39.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.40.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.41.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.42.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.43.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.44.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.45.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.46.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.47.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.48.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.49.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.50.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.51.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.52.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.53.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.54.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.55.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.56.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.57.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.58.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.59.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.60.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.61.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.62.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.63.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.64.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.65.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.66.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.67.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.68.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.68.1 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.69.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.70.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.71.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.72.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.73.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.73.1 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.8.1 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.8.2 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.9.0 | No fix listed |
| net.bull.javamelody/javamelody-core(Maven) | = 1.9.3 | No fix listed |
| javamelody project javamelody | < 1.74.0 | 1.74.0 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch vendor-advisory
- github.com vendor-advisory
- github.com release-notes vendor-advisory
- jenkins.io third-party-advisory
- [oss-security] 20180925 Multiple vulnerabilities in Jenkins plugins mailing-list third-party-advisory
- github.com product