CVE-2017-7545

🗓️ 26 Jul 2018 15:00:00Reported by redhatType

XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXternal Entity (XXE) attacks.

Reporter	Title	Published	Views	Family All 14
CNVD	jBPM Migration XML External Entity Injection Vulnerability	18 Dec 201700:00	–	cnvd
Cvelist	CVE-2017-7545	26 Jul 201815:00	–	cvelist
EUVD	EUVD-2022-5332	3 Oct 202520:07	–	euvd
Github Security Blog	XML External Entity Reference in jbpmmigration	13 May 202201:36	–	github
NVD	CVE-2017-7545	26 Jul 201815:29	–	nvd
OSV	CVE-2017-7545	26 Jul 201815:29	–	osv
OSV	GHSA-VC3X-72Q4-G3P5 XML External Entity Reference in jbpmmigration	13 May 202201:36	–	osv
Prion	Xxe	26 Jul 201815:29	–	prion
RedhatCVE	CVE-2017-7545	30 Nov 201716:19	–	redhatcve
RedHat Linux	Moderate: Red Hat Security Advisory: Red Hat JBoss BRMS 6.4.7 security update	30 Nov 201716:47	–	redhat

NVD

Vulners

Node

redhat decision_managerMatch7.0

redhat jboss_bpm_suiteMatch6.4

redhat jbpmMatch6.5

[
  {
    "product": "jbpm-designer",
    "vendor": "KIE",
    "versions": [
      {
        "status": "affected",
        "version": "6.5"
      }
    ]
  }
]

Source	Link
securityfocus	www.securityfocus.com/bid/102179
access	www.access.redhat.com/errata/RHSA-2017:3355
access	www.access.redhat.com/errata/RHSA-2017:3354
github	www.github.com/kiegroup/jbpm-designer/commit/a143f3b92a6a5a527d929d68c02a0c5d914ab81d
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

21 Nov 2024 03:32Current

6.3Medium risk

Vulners AI Score6.3

CVSS 24

CVSS 36.5

EPSS0.00774

CWE-611