Medium severity · published Jul 26, 2018
CVE-2017-7545
It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files
6.5
CVSS
2.7%
EPSS
No
On KEV
Description
It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXternal Entity (XXE) attacks.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Decision Manager · Redhat
7.0 · source: NVD
JB
Jboss Bpm Suite · Redhat
6.4 · source: NVD
JB
Jbpm · Redhat
6.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7545
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7545
Third Party Advisory
http://www.securityfocus.com/bid/102179
Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3354
Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3355
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7545
Patch
https://github.com/kiegroup/jbpm-designer/commit/a143f3b92a6a5a527d929d68c02a0c5d914ab81d
More from Decision Manager
9.8
CVE-2019-14892
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using…
9.8
CVE-2018-19360
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic…
9.8
CVE-2018-19361
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization
9.8
CVE-2018-19362
FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic…
8.8
CVE-2022-1415
A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data