XML External Entity (XXE)

2019-07-0814:05:04

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

24.1%

JSON

apache syncope is vulnerable to XML external entity attacks (XXE). An attacker is able to read and write arbitrary files and execute arbitrary code using malicious DTDs in the workflow definition entitlements.

CPENameOperatorVersion
apache syncope client consolele2.1.2
apache syncope client consolele2.0.10
apache syncope ext: flowable bpmneq2.1.2
apache syncope client consolele2.1.2
apache syncope client consolele2.0.10
apache syncope ext: flowable bpmneq2.1.2

Name	Operator	Version
apache syncope client console	le	2.1.2
apache syncope client console	le	2.0.10
apache syncope ext: flowable bpmn	eq	2.1.2
apache syncope client console	le	2.1.2
apache syncope client console	le	2.0.10
apache syncope ext: flowable bpmn	eq	2.1.2

References

syncope.apache.org/security#CVE-2018-17186:_XXE_on_BPMN_definitions

0.001 Low

EPSS

Percentile

24.1%

JSON

Related for VERACODE:20728