An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.
References
Link | Resource |
---|---|
https://syncope.apache.org/security#CVE-2018-17186:_XXE_on_BPMN_definitions | Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2018-11-06 20:29
Updated : 2024-02-28 16:48
NVD link : CVE-2018-17186
Mitre link : CVE-2018-17186
CVE.ORG link : CVE-2018-17186
JSON object : View
Products Affected
apache
- syncope
CWE
CWE-611
Improper Restriction of XML External Entity Reference