Vulnerability CVE-2018-5758


Published: 2018-03-12   Modified: 2018-03-13

Description:
The Upload File functionality in upload.jspa in Aurea Jive Jive-n 9.0.2.1 On-Premises allows for an XML External Entity attack through a crafted file, allowing attackers to read arbitrary files.

Type:

CWE-611

(Information Exposure Through XML External Entity Reference)

CVSS2 => (AV:N/AC:L/Au:S/C:C/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.9/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Complete
None
None
Affected software
Aurea -> Jive-n 

 References:
https://rhinosecuritylabs.com/research/xml-external-entity-injection-xxe-cve-2018-5758/

Copyright 2022, cxsecurity.com

 

Back to Top