CVE-2018-1000644

EPSS 0.38%
Published 20.08.2018 19:31:39
Last modified 21.11.2024 03:40:18
Source cve@mitre.org
Teams watchlist Login
Open Login

Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Eclipse ≫ Rdf4j Version < 2.4.0

Eclipse ≫ Rdf4j Version2.4.0 Update-

Eclipse ≫ Rdf4j Version2.4.0 Updatem1

Eclipse ≫ Rdf4j Version2.4.0 Updatem2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.38%	0.563

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	10	3.9	6	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

https://0dd.zone/2018/08/05/rdf4j-XXE/

Third Party Advisory

https://github.com/eclipse/rdf4j/issues/1056

Patch

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2018-1000644

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-1000644

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-1000644

EUVD