CVE-2018-17186 Security Details

CVE ID

CVE-2018-17186

CWE

CWE-611

CVE Description

An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.

Published

Feb 20, 2019

CVSS Score & Severity

7.2High

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.561%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/apache/syncope/client/console/widgets/reconciliation/ReconciliationReportParser.parse(Ljava/util/Date;Ljava/io/InputStream;)Lorg/apache/syncope/client/console/widgets/reconciliation/ReconciliationReport;

JVMVulnerable params: 1

Affected Ecosystems

affected

Source

National Vulnerability Database

References

Apache · AnnouncementPROJECT

Apache · Security advisoryPROJECT