CVE-2018-15531

published 2018-09-26

CVE-2018-15531: JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.

Priority P3 56 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.

Affected

34 ranges · showing 25

Vendor	Product	Version range	Fixed in
javamelody_project	javamelody	< 1.74.0	1.74.0
jenkins	arachni_scanner_plugin	—	—
jenkins	argus_notifier_plugin	—	—
jenkins	artifactory_plugin	—	—
jenkins	chatter_notifier_plugin	—	—
jenkins	config_file_provider_plugin	—	—
jenkins	credentials_plugin	—	—
jenkins	crowd_2_integration_plugin	—	—
jenkins	dimensions_plugin	—	—
jenkins	email_extension_template_plugin	—	—
jenkins	git_changelog_plugin	—	—
jenkins	hipchat_plugin	—	—
jenkins	ids_in_argus_notifier_plugin	—	—
jenkins	ids_in_chatter_notifier_plugin	—	—
jenkins	ids_in_hipchat_plugin	—	—
jenkins	ids_in_mesos_plugin	—	—
jenkins	ids_to_allow_administrators_configuring_the_plugin	—	—
jenkins	ids_to_allow_users_configuring_the_plugin	—	—
jenkins	javamelody_library_bundled_in_monitoring_plugin	—	—
jenkins	jira_plugin	—	—
jenkins	job_config_history_plugin	—	—
jenkins	job_configuration_history_plugin	—	—
jenkins	junit_plugin	—	—
jenkins	mesos_cloud_plugin	—	—
jenkins	mesos_plugin	—	—

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-611