Description
bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the Middle or malicious server.
Remediation
References
https://0dd.zone/2018/10/28/bw-calendar-engine-XXE-MitM/
https://github.com/Bedework/bw-calendar-engine/issues/3
Related Vulnerabilities
CVE-2021-39236 Vulnerability in maven package org.apache.ozone:ozone-main
CVE-2018-1999005 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2016-10606 Vulnerability in npm package grunt-webdriver-qunit
CVE-2019-10398 Vulnerability in maven package org.jenkins-ci.plugins:beaker-builder
CVE-2019-9843 Vulnerability in maven package com.diffplug.spotless:spotless-maven-plugin