Server-side Request Forgery and File Enumeration in Apache Roller
CVE-2018-17198

9.8CRITICAL

Key Information:

Vendor
Apache
Status
Apache Roller
Vendor
CVE Published:
28 May 2019

Summary

Apache Roller versions 5.2.1, 5.2.0, and earlier unsupported releases are susceptible to a Server-side Request Forgery (SSRF) and File Enumeration vulnerability due to the use of the Java SAX Parser in its XML-RPC interface. By default, this parser permits external entities in XML DOCTYPE declarations, rendering the application vulnerable even if the XML-RPC feature is disabled via the web admin interface. To mitigate this issue, users are advised to upgrade to Apache Roller 5.2.2 or modify the web.xml configuration file to disable the XML-RPC Servlet mapping.

Affected Version(s)

Apache Roller 5.2.1

Apache Roller 5.2.0

Apache Roller earlier unsupported versions

References

https://lists.apache.org/thread.html/94a36ed9c6241558b1c6...
x_refsource_MISC
http://www.securityfocus.com/bid/108496
vdb-entryx_refsource_BID

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.