Description

Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java.

Remediation

References

https://github.com/Bedework/bw-webdav/compare/bw-webdav-4.0.2...bw-webdav-4.0.3

https://github.com/Bedework/bw-webdav/pull/1

Related Vulnerabilities

CVE-2021-31635 Vulnerability in maven package com.jfinal:jfinal

CVE-2021-3644 Vulnerability in maven package org.wildfly.core:wildfly-controller

CVE-2013-6393 Vulnerability in npm package libyaml

CVE-2018-11784 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2018-3723 Vulnerability in npm package defaults-deep

Severity

High

Classification

CWE-611 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Patch Third Party Advisory