CVE-2018-11761

EPSS 12.93%
Published 19.09.2018 14:29:00
Last modified 21.11.2024 03:43:58
Source security@apache.org
Teams watchlist Login
Open Login

In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.

Affected products Warnungen 0 Metrics 3 CWE 1 References 7

Data is provided by the National Vulnerability Database (NVD)

Apache ≫ Tika Version >= 0.1 <= 1.18

Oracle ≫ Business Process Management Suite Version12.1.3.0.0

Oracle ≫ Business Process Management Suite Version12.2.1.3.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	12.93%	0.938

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:N/A:P

CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Patch

Third Party Advisory

http://www.securityfocus.com/bid/105514

Third Party Advisory

VDB Entry

https://lists.apache.org/thread.html/5553e10bba5604117967466618f219c0cae710075819c70cfb3fb421%40%3Cdev.tika.apache.org%3E

https://nvd.nist.gov/vuln/detail/CVE-2018-11761

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-11761

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-11761

EUVD