CVE-2018-1000854 Remote Code Execution in esigate-core
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2018-1000854?
CVE-2018-1000854 is a critical vulnerability in n/a, published on 20 Dec 2018.
Official description
esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable via Use of another weakness in backend application to reflect ESI directives. This vulnerability appears to have been fixed in 5.3.
Weakness: CWE-74
Which versions are affected by CVE-2018-1000854?
2 open source packages ship an affected version, including org.esigate:esigate-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.esigate:esigate-core Maven | All versions | 5.3 |
org.esigate:esigate-core Maven | All versions | 5.3 |
Products include Esigate Esigate.
How do I fix CVE-2018-1000854?
Upgrade org.esigate:esigate-core to 5.3 or later.
Is CVE-2018-1000854 being exploited?
There is no known exploitation of CVE-2018-1000854 in the wild and no public exploit code.
Sources
Also known as GHSA-hjm9-576q-399p.