CVE-2018-12544 Moderate severity vulnerability that affects io.vertx:vertx-core
Attackers can exploit XML External Entity vulnerabilities in Eclipse Vert.x OpenAPI validator to read sensitive data or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-12544?
CVE-2018-12544 is a critical vulnerability in The Eclipse Foundation Eclipse Vert.x, published on 10 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema.
Weakness: CWE-611
Which versions are affected by CVE-2018-12544?
2 open source packages ship an affected version, including io.vertx:vertx-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.vertx:vertx-core Maven | From 3.5.0 | 3.5.4 |
io.vertx:vertx-core Maven | From 3.5.0 | 3.5.4 |
Products include Eclipse Vert.x.
How do I fix CVE-2018-12544?
Upgrade io.vertx:vertx-core to 3.5.4 or later.
Is CVE-2018-12544 being exploited?
There is no known exploitation of CVE-2018-12544 in the wild and no public exploit code.
Other vulnerabilities in The Eclipse Foundation Eclipse Vert.x
- CVE-2019-17640 Path Traversal in Eclipse Vert
- CVE-2018-12542 Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location
- CVE-2026-102469 Deserialization in Eclipse Vert.x
- CVE-2018-12540 High severity vulnerability that affects io.vertx:vertx-web
- CVE-2026-102461 Denial of service in Eclipse Vert.x
Sources
Also known as GHSA-qh3m-qw6v-qvhg.