Description

bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the Middle or malicious server.

Remediation

References

https://0dd.zone/2018/10/28/bw-calendar-engine-XXE-MitM/

https://github.com/Bedework/bw-calendar-engine/issues/3

Related Vulnerabilities

CVE-2020-2157 Vulnerability in maven package org.jenkins-ci.plugins:skytap

CVE-2019-10425 Vulnerability in maven package org.jvnet.hudson.plugins:gcal

CVE-2019-10418 Vulnerability in maven package io.fabric8.pipeline:kubernetes-pipeline-arquillian-steps

CVE-2022-22984 Vulnerability in npm package @snyk/snyk-hex-plugin

CVE-2018-25031 Vulnerability in maven package com.microfocus.webjars:swagger-ui-dist

Severity

Critical

Classification

CWE-611 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Tags

Third Party Advisory