CVE-2019-10244

2019-04-0916:29:01

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.9%

JSON

In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service (not part of the device distribution) could potentially be target of XXE attack due to an improper factory and parser initialisation.

CPENameOperatorVersion
kuraeqKURA_3.0.0_M1
kuraeqKURA_1.1.1_RELEASE
kuraeqKURA_3.1.0_RELEASE
kuraeqKURA_1.2.0_RC3
kuraeqKURA_1.2.0_RELEASE
kuraeqKURA_1.2.0_RC5
kuraeqKURA_1.1.2_RELEASE
kuraeqKURA_1.2.1_RELEASE
kuraeqKURA_1.2.1_RC3
kuraeqKURA_1.2.1_RC2

Name	Operator	Version
kura	eq	KURA_3.0.0_M1
kura	eq	KURA_1.1.1_RELEASE
kura	eq	KURA_3.1.0_RELEASE
kura	eq	KURA_1.2.0_RC3
kura	eq	KURA_1.2.0_RELEASE
kura	eq	KURA_1.2.0_RC5
kura	eq	KURA_1.1.2_RELEASE
kura	eq	KURA_1.2.1_RELEASE
kura	eq	KURA_1.2.1_RC3
kura	eq	KURA_1.2.1_RC2