CVE-2018-20000 Improper Restriction of XML External Entity Reference in bedework:bw-webdav
An attacker can exploit an XML External Entity vulnerability in Bedework to read local files via a crafted invite-reply document.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-20000?
CVE-2018-20000 is a high-severity vulnerability in n/a, published on 10 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java.
Weakness: CWE-611
Which versions are affected by CVE-2018-20000?
2 open source packages ship an affected version, including org.bedework:bw-webdav. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.bedework:bw-webdav Maven | From 4.0.1 | 4.0.3 |
org.bedework:bw-webdav Maven | From 4.0.1 | 4.0.3 |
Products include Apereo Bw-Webdav.
How do I fix CVE-2018-20000?
Upgrade org.bedework:bw-webdav to 4.0.3 or later.
Is CVE-2018-20000 being exploited?
There is no known exploitation of CVE-2018-20000 in the wild and no public exploit code.
Sources
Also known as GHSA-5p52-j8pw-j7x5.