XML External Entity Injection in JavaMelody by Lz4
CVE-2018-15531

9.8CRITICAL

Key Information:

Vendor

Javamelody Project

Status
Javamelody
Vendor
CVE Published:
26 September 2018

What is CVE-2018-15531?

A vulnerability exists in JavaMelody prior to version 1.74.0 that allows for XML External Entity (XXE) injection through the parseSoapMethodName function, located in the PayloadNameRequestWrapper.java file. This weakness could potentially allow an attacker to read sensitive files or conduct other malicious activities on the server by manipulating XML data.

References

http://www.openwall.com/lists/oss-security/2018/09/25/3
mailing-listx_refsource_MLIST
https://github.com/javamelody/javamelody/commit/ef1118225...
x_refsource_CONFIRM
https://github.com/javamelody/javamelody/wiki/ReleaseNotes
x_refsource_CONFIRM

EPSS Score

27% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.