XML External Entity Injection (XXE)

2018-12-2109:33:16

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

52.9%

JSON

bw-calendar-engine-impl is vulnerable to XML external entity injection (XXE). The vulnerability exists since the IscheduleClient XML parser does not restrict external DTDs which would allow an attacker to perform XXE attacks via a crafted XML document.

CPENameOperatorVersion
bedework: calendar engine - api implementationle3.13.2

CPE	Name	Operator	Version
	bedework: calendar engine - api implementation	le	3.13.2

References

github.com/Bedework/bw-calendar-engine/blob/6c99a071ca573a23a8c99674c8f9980169b5f535/bw-calendar-engine-impl/src/main/java/org/bedework/calsvc/scheduling/hosts/IscheduleClient.java#L422

github.com/Bedework/bw-calendar-engine/issues/3

0.002 Low

EPSS

Percentile

52.9%

JSON

Related for VERACODE:8064