CVE-2018-12585 XML external entity in n/a
Remote attackers can cause denial of service in OPC UA Java and .NET Legacy Stack via XML External Entity injection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-12585?
CVE-2018-12585 is a high-severity vulnerability in n/a, published on 14 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An XXE vulnerability in the OPC UA Java and .NET Legacy Stack can allow remote attackers to trigger a denial of service.
Weakness: CWE-611
Which versions are affected by CVE-2018-12585?
It affects 2 products.
Products include Opcfoundation Ua-.Net-Legacy, Opcfoundation Ua-Java.
How do I fix CVE-2018-12585?
No fix has been published for CVE-2018-12585 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-12585 being exploited?
There is no known exploitation of CVE-2018-12585 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2017-12070 Supply chain in n/a
- CVE-2021-27432 Denial of service in OPC Foundation OPC UA .NET Standard and OPC UA .NET Legacy
- CVE-2018-12087 Moderate severity vulnerability that affects OPCFoundation.NetStandard.Opc.Ua
- CVE-2018-7559 OPC UA applications can allow a remote attacker to determine a Server's private key
Sources
Also known as GHSA-h57p-mm7w-9rcx.