CVE-2017-18197

Опубликовано: 24 фев. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView.

Ссылки

https://github.com/jgraph/mxgraph/issues/124
Exploit
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/03/msg00002.html
Third Party Advisory
https://github.com/jgraph/mxgraph/issues/124
Exploit
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/03/msg00002.html
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jgraph:mxgraph:*:*:*:*:*:*:*:*

Версия до 3.7.5 (включая)

EPSS

Процентиль: 63%

0.0044

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-611

Связанные уязвимости

CVE-2017-18197

CVSS3: 9.8

ubuntu

почти 8 лет назад

In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView.

CVE-2017-18197

CVSS3: 4.8

redhat

около 8 лет назад

In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView.

CVE-2017-18197

CVSS3: 9.8

debian

почти 8 лет назад

In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserF ...

openSUSE-SU-2018:0616-1

suse-cvrf

почти 8 лет назад

Security update for jgraphx

GHSA-wvpv-8524-wg6x

CVSS3: 9.8

github

больше 3 лет назад

mxGraph vulnerable to XXE attacks

EPSS

Процентиль: 63%

0.0044

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-611