Lucene search

MitreCVE-2018-1000090

HistoryMar 13, 2018 - 3:29 p.m.

CVE-2018-1000090

2018-03-1315:29:01

CWE-611

mitre

web.nvd.nist.gov

textpattern

xml injection

dos

vulnerability

cve-2018-1000090

nvd

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

39.3%

JSON

textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web server by exhausting server memory resources. This attack appear to be exploitable via Uploading a specially crafted XML file.

Affected configurations

Nvd

Node

textpatterntextpatternMatch4.6.2

VendorProductVersionCPE
textpatterntextpattern4.6.2cpe:2.3:a:textpattern:textpattern:4.6.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
textpattern	textpattern	4.6.2	cpe:2.3:a:textpattern:textpattern:4.6.2:::::::*

References

github.com/textpattern/textpattern/issues/1141

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

39.3%

JSON

Related for CVE-2018-1000090