Description
An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.
Remediation
References
https://syncope.apache.org/security#CVE-2018-17186:_XXE_on_BPMN_definitions
Related Vulnerabilities
CVE-2022-45921 Vulnerability in maven package io.fusionauth:fusionauth-java-client
CVE-2016-4434 Vulnerability in maven package org.apache.tika:tika-parsers
CVE-2023-28155 Vulnerability in npm package request
CVE-2016-3086 Vulnerability in maven package org.apache.hadoop:hadoop-common
CVE-2020-13933 Vulnerability in maven package org.apache.shiro:shiro-web