Entity Expansion Vulnerability in Apache jUDDI by The Apache Software Foundation

CVE-2018-1307

What is CVE-2018-1307?

In Apache jUDDI versions 3.2 through 3.3.4, there are inadequate protections against entity expansion and Document Type Definition (DTD) attacks when utilizing the WADL2Java or WSDL2Java classes to parse local or remote XML documents. This lack of safeguards can lead to XML-related attacks that may compromise the integrity and availability of the application. It is advisable to upgrade to version 3.3.5 or later to mitigate these security risks.

References