jgraph/mxgraph · Security
mxGraph vulnerable to XXE attacks
- GHSA ID
- GHSA-wvpv-8524-wg6x
- CVE ID
- CVE-2017-18197
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView.
CWEs
- CWE-611 · Improper Restriction of XML External Entity Reference