What is GHSA-xmvg-w4f9-99r7?

GHSA-xmvg-w4f9-99r7 is a security advisory published by GitHub Security Advisories with Critical severity. XML External Entity (XXE) vulnerability in bw-calendar-engine

Which CVE IDs does GHSA-xmvg-w4f9-99r7 cover?

GHSA-xmvg-w4f9-99r7 covers the following CVE IDs: CVE-2018-1000836. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xmvg-w4f9-99r7?

GHSA-xmvg-w4f9-99r7 has a CVSS v3 base score of 9.0, published by GitHub Security Advisories.

Which products are affected by GHSA-xmvg-w4f9-99r7?

GHSA-xmvg-w4f9-99r7 affects 1 product, including: maven/org.bedework.caleng:bw-calendar-engine:\u003c= 3.12.2.

GHSA-xmvg-w4f9-99r7CriticalCVSS 9.0

XML External Entity (XXE) vulnerability in bw-calendar-engine

Vendor

GitHub Security Advisories

Published

December 20, 2018

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2018-1000836 →

📋 Description

bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the Middle or malicious server.

🎯 Affected products1

maven/org.bedework.caleng:bw-calendar-engine:<= 3.12.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000836
https://github.com/Bedework/bw-calendar-engine/issues/3
https://0dd.zone/2018/10/28/bw-calendar-engine-XXE-MitM/
https://github.com/advisories/GHSA-xmvg-w4f9-99r7