CVE-2017-7545

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXternal Entity (XXE) attacks.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
KIE	jbpm-designer	6.5

References

http://www.securityfocus.com/bid/102179Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:3354Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3355Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7545Issue Tracking, Patch, Vendor Advisory
https://github.com/kiegroup/jbpm-designer/commit/a143f3b92a6a5a527d929d68c02a0c5d914ab81dPatch, Third Party Advisory
http://www.securityfocus.com/bid/102179Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:3354Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3355Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7545Issue Tracking, Patch, Vendor Advisory
https://github.com/kiegroup/jbpm-designer/commit/a143f3b92a6a5a527d929d68c02a0c5d914ab81dPatch, Third Party Advisory

Timeline

Published: Jul 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-75469.8PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers CVE-2017-75478.8PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attack CVE-2017-75487.5PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no priv CVE-2017-75496.4A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform CVE-2017-75509.8A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Rem CVE-2017-75519.8389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different retur CVE-2017-75529.8A flaw was discovered in the file editor of millicore, affecting versions before 3.19.0 and 4.x before 4.5.0, which allows files to be execu CVE-2017-75536.3The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker could use this flaw to probe CVE-2017-75546.1It was found that the App Studio component of RHMAP 4.4 executes javascript provided by a user. An attacker could use this flaw to execute a CVE-2017-75559.8Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker CVE-2017-75568.8Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their we CVE-2017-75578.8dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.