CVE-2018-1000822 XML External Entity (XXE) vulnerability in codelibs fess
Attackers can exploit an XML External Entity vulnerability in the GSA XML parser to disclose confidential data or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000822?
CVE-2018-1000822 is a critical vulnerability in n/a, published on 20 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via specially crafted GSA XML files. This vulnerability appears to have been fixed in after commit faa265b.
Weakness: CWE-611
Which versions are affected by CVE-2018-1000822?
2 open source packages ship an affected version, including org.codelibs.fess:fess. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.codelibs.fess:fess Maven | All versions | 12.3.2 |
org.codelibs.fess:fess Maven | All versions | 12.3.2 |
Products include Codelibs Fess.
How do I fix CVE-2018-1000822?
Upgrade org.codelibs.fess:fess to 12.3.2 or later.
Is CVE-2018-1000822 being exploited?
There is no known exploitation of CVE-2018-1000822 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-77hp-pfxw-4w63.