CVE-2018-20000

EUVD-2018-0798 · Published Dec 19, 2018

Improper Restriction of XML External Entity Reference in bedework:bw-webdav

Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java.

Technologies

Apereo Bw-Webdav

Weaknesses

CWE-611

CVSS scores

v3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://github.com/Bedework/bw-webdav/compare/bw-webdav-4.0.2...bw-webdav-4.0.3
https://github.com/Bedework/bw-webdav/pull/1
https://nvd.nist.gov/vuln/detail/CVE-2018-20000
https://github.com/Bedework/bw-webdav
https://github.com/advisories/GHSA-5p52-j8pw-j7x5

Potentially impacted assets

See if this affects your attack surface