CRITICAL🇵🇱 Wersja polska

CVE-2018-1000644

CVSS 10.0v3.0pub. 2018-08-20upd. 2024-11-21

Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Eclipse Rdf4j

    APP
    Eclipse
    2.4.0< 2.4.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
DoSXXE
CWE
References

Related vulnerabilities

CVE-2018-20227HIGH7.5same product

RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.

CVE-2026-12605CRITICAL9.6PL ✓same vendor

Eclipse GlassFish: CSRF+SSRF w DownloadServlet umożliwia przejęcie domeny

CVE-2026-60007CRITICAL9.1PL ✓same vendor

Eclipse Milo: padding oracle w uwierzytelnianiu OPC-UA umożliwia odzyskanie hasła

CVE-2026-2586CRITICAL9.1PL ✓same vendor

RCE w konsoli administracyjnej Eclipse GlassFish

CVE-2026-2587CRITICAL9.6PL ✓same vendor

RCE poprzez wstrzyknięcie Expression Language w Eclipse GlassFish