CVE-2018-1000836

2022-10-0316:21:59

mitre

www.cve.org

cve-2018-1000836

xml external entity

ischeduleclient xml parser

disclosure of confidential data

denial of service

ssrf

man in the middle

malicious server

9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.0%

JSON

bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the Middle or malicious server.