XML External Entity Vulnerability in Apache Cayenne's CayenneModeler Tool

CVE-2018-11758

What is CVE-2018-11758?

Apache Cayenne's CayenneModeler, a desktop GUI tool for editing ORM models stored as XML, is susceptible to an XML External Entity (XXE) vulnerability. This allows attackers to manipulate users into opening malicious XML files. If exploited, this could enable attackers to instruct the built-in XML parser to transfer files from the user's local environment to a remote server under their control. To mitigate this security risk, XXE processing has been disabled in all operations that require XML parsing within Cayenne.

References