CVE-2018-1077 — XML External Entity (XXE) Injection in Spacewalk

CWE-611 — XML External Entity (XXE) Injection7 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 55.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
SpacewalkRedhat SatelliteRedhat Spacewalk
Timeline
PublishedMar 14
Latest updateMay 13

Description

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5spacewalk/spacewalk2.6

🔴Vulnerability Details

2
GHSA
GHSA-c447-rp4f-fgvj: Spacewalk 2↗2022-05-13
▶
CVEList
CVE-2018-1077: Spacewalk 2↗2018-03-14
▶

📋Vendor Advisories

1
Red Hat
spacewalk: XML External Entity (XXE) on Spacewalk APIs↗2018-03-12
▶

💬Community

3
Bugzilla
CVE-2020-1693 spacewalk: XML entity attacks on /rpc/api↗2020-01-13
▶
Bugzilla
CVE-2017-18594 nmap: denial of service condition due to a double free when SSH connection fails↗2019-09-05
▶
Bugzilla
CVE-2018-1077 spacewalk: XML External Entity (XXE) on Spacewalk APIs↗2018-03-14
▶
CVE-2018-1077 — XML External Entity (XXE) Injection | cvebase