CVE-2017-7464 XML external entity in JBoss
Attackers can cause denial of service, SSRF, or information disclosure via XML external entity attacks in JBoss EAP parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-7464?
CVE-2017-7464 is a high-severity vulnerability in Redhat Jboss Enterprise Application Platform, published on 27 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE flaws. An attacker could use this flaw to cause DoS, SSRF, or information disclosure if they are able to provide XML content for parsing.
Weakness: CWE-611
Which versions are affected by CVE-2017-7464?
It affects 1 product.
Products include Redhat Jboss Enterprise Application Platform.
How do I fix CVE-2017-7464?
No fix has been published for CVE-2017-7464 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-7464 being exploited?
There is no known exploitation of CVE-2017-7464 in the wild and no public exploit code.
Other vulnerabilities in Redhat Jboss Enterprise Application Platform
- CVE-2017-12149 Red Hat JBoss Application Server Remote Code Execution
- CVE-2010-1428 Red Hat JBoss Information Disclosure
- CVE-2010-0738 Red Hat JBoss Authentication Bypass
- CVE-2016-3690 Deserialization in n/a
- CVE-2017-7504 Deserialization in JBoss
All Redhat Jboss Enterprise Application Platform vulnerabilities
Sources
Also known as GHSA-9x6m-hc4p-vjq7.