Vulnerabilities > CVE-2018-20059 - XXE vulnerability in Pippo 1.11.0

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

critical

NVD

Published: 2018-12-11

Updated: 2019-01-03

Summary

jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.

Vulnerable Configurations

Part	Description	Count
Application	Pippo Pippo Pippo 1.11.0	1

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

References

https://github.com/pippo-java/pippo/issues/486

CVE is a registered MITRE Corporation trademark and MITRE's CVE website is the authoritative source of CVE content. CWE is a registered MITRE Corporation trademark and MITRE's CWE website is the authoritative source of CWE content.