Description

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.

Remediation

References

http://www.openwall.com/lists/oss-security/2018/09/25/3

https://github.com/javamelody/javamelody/commit/ef111822562d0b9365bd3e671a75b65bd0613353

https://github.com/javamelody/javamelody/wiki/ReleaseNotes

https://jenkins.io/security/advisory/2018-09-25/

Related Vulnerabilities

CVE-2019-25027 Vulnerability in maven package com.vaadin:flow-server

CVE-2019-10247 Vulnerability in maven package org.eclipse.jetty:jetty-server

CVE-2017-10355 Vulnerability in maven package xerces:xercesimpl

CVE-2020-13925 Vulnerability in maven package org.apache.kylin:kylin-server

CVE-2020-12827 Vulnerability in npm package mjml

Severity

Critical

Classification

CWE-611 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory Patch Vendor Advisory Release Notes