CVE-2018-1307

HIGH

Apache jUDDI 3.2-3.3.4 - XML External Entity Injection via WADL2Java or WSDL2Java

Title source: llm

Description

In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD type of attacks. Mitigation is to use 3.3.5.

References (2)

Core 2

Core References

Issue Tracking, Patch, Vendor Advisory x_refsource_confirm

https://issues.apache.org/jira/browse/JUDDI-987

Vendor Advisory x_refsource_confirm

http://juddi.apache.org/security.html

Scores

CVSS v3 8.1

EPSS 0.0112

EPSS Percentile 78.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-611

Status published

Products (2)

apache/juddi 3.2 - 3.3.4

org.apache.juddi/juddi-client 3.2 - 3.3.5Maven

Published Feb 09, 2018

Tracked Since Feb 18, 2026