CVE-2015-1818
published 2015-08-11CVE-2015-1818: XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss…
PriorityP343high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
2.24%
80.9th percentile
XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | jboss_bpm_suite | <= 6.1.0 | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
dashbuilder: XXE/SSRF vulnerability
vendor_redhat·2015-03-13·CVSS 7.5
CVE-2015-1818 [HIGH] CWE-611 dashbuilder: XXE/SSRF vulnerability
dashbuilder: XXE/SSRF vulnerability
XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.
A flaw was found in the dashbuilder import facility: the DocumentBuilders instantiated in org.jboss.dashboard.export.ImportManagerImpl did not disable external entities. This could allow an attacker to perform a variety of XML External Entity (XXE) and Server-Side Request Forgery (SSRF) attacks.
GHSA
GHSA-c64m-pjpp-mqqj: XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org
ghsa_unreviewed·2022-05-14
CVE-2015-1818 [HIGH] GHSA-c64m-pjpp-mqqj: XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org
XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.
No detection rules found.
No public exploits indexed.
2015-08-11
Published