CVE-2017-18197

CRITICAL9.8EPSS 0.44%

mxGraph vulnerable to XXE attacks

Published: 5/14/2022Modified: 11/8/2023

Also known as:GHSA-wvpv-8524-wg6xDEBIAN-CVE-2017-18197

Description

In `mxGraphViewImageReader.java` in mxGraph before 3.7.6, the `SAXParserFactory` instance in `convert()` is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by `/ServerView`.

Affected packages (3)

Debian/libjgraphx-javafrom 0, < 2.1.0.7-2
Debian/libjgraphx-javafrom 0, < 1.4.1.0-3+deb7u1
npm/mxgraphfrom 0, < 3.7.6

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2017-18197
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2017-18197
PATCHhttps://github.com/jgraph/mxgraph
WEBhttps://github.com/jgraph/mxgraph/commit/97b3718db64a6ca9afb3382de2926eb8da660052
WEBhttps://github.com/jgraph/mxgraph/issues/124
WEBhttps://lists.debian.org/debian-lts-announce/2018/03/msg00002.html