Vulnerabilities > CVE-2018-20059 - XXE vulnerability in Pippo 1.11.0

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

low complexity

NVD

Published: 2018-12-11

Updated: 2019-01-03

Summary

jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.

Vulnerable Configurations

Part	Description	Count
Application	Pippo Pippo Pippo 1.11.0	1

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

References

https://github.com/pippo-java/pippo/issues/486

CVE is a registered MITRE Corporation trademark and MITRE's CVE website is the authoritative source of CVE content. CWE is a registered MITRE Corporation trademark and MITRE's CWE website is the authoritative source of CWE content.