XXE attack in Pivotal Spring Data Commons - CVE-2018-1259
Published: May 21, 2018
Vulnerability identifier: #VU12858
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1259
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information on the target system.
The weakness exists due to improper restriction of XML external entity references. The underlying XMLBeam library does not restrict external reference expansion. A remote attacker can supply specially crafted request parameters and gain access to arbitrary files.
The weakness exists due to improper restriction of XML external entity references. The underlying XMLBeam library does not restrict external reference expansion. A remote attacker can supply specially crafted request parameters and gain access to arbitrary files.
Affected software
Pivotal Spring Data Commons
How to mitigate CVE-2018-1259
Update to version 1.13.12 or 2.0.7.