GHSA-77hp-pfxw-4w63

XML External Entity (XXE) vulnerability in codelibs fess

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-1000822

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.codelibs.fess:fess	< 12.3.2	12.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via specially crafted GSA XML files. This vulnerability appears to have been fixed in after commit faa265b.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000822 advisory
https://github.com/codelibs/fess/issues/1851 web
https://0dd.zone/2018/10/27/fess-XXE web
https://github.com/advisories/GHSA-77hp-pfxw-4w63 advisory
https://github.com/codelibs/fess package