What is GHSA-6fvx-r7hx-3vh6?

GHSA-6fvx-r7hx-3vh6 is a security advisory published by GitHub Security Advisories with Critical severity. JavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.

Which CVE IDs does GHSA-6fvx-r7hx-3vh6 cover?

GHSA-6fvx-r7hx-3vh6 covers the following CVE IDs: CVE-2018-15531. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6fvx-r7hx-3vh6?

GHSA-6fvx-r7hx-3vh6 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-6fvx-r7hx-3vh6?

GHSA-6fvx-r7hx-3vh6 affects 1 product, including: maven/net.bull.javamelody:javamelody-core:\u003c 1.74.0.

GHSA-6fvx-r7hx-3vh6CriticalCVSS 9.8

JavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.

Vendor

GitHub Security Advisories

Published

October 17, 2018

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2018-15531 →

📋 Description

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.

🎯 Affected products1

maven/net.bull.javamelody:javamelody-core:< 1.74.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2018-15531
https://github.com/javamelody/javamelody/commit/ef111822562d0b9365bd3e671a75b65bd0613353
https://github.com/advisories/GHSA-6fvx-r7hx-3vh6
https://github.com/javamelody/javamelody/wiki/ReleaseNotes
https://jenkins.io/security/advisory/2018-09-25/
http://www.openwall.com/lists/oss-security/2018/09/25/3