CVE-2018-1307 json
Apache juddi-client vulnerable to XML External Entity (XXE)
published 2018-02-09 8 y ago modified 2026-06-17 4 mo ago also GHSA-p99p-726h-c8v5 , EUVD-2018-0651
- cvss
- 8.1
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD type of attacks. Mitigation is to use 3.3.5.
Patch / fix
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2018-1307 updated cvss 4.3
juddi-client: XML Entity Expansion in WADL2Java or WSDL2Java classes
-
Red Hat JBoss Enterprise Application Platform 6 juddi-client juddi-client Red Hat JBoss Fuse 6 juddi-client juddi-client Red Hat JBoss Operations Network 3 juddi-client juddi-client Red Hat JBoss Portal 6 juddi-client juddi-client Red Hat JBoss SOA Platform 5 juddi-client juddi-clientnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.67% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.juddi:juddi-client | >=3.2, <3.3.5 |
3.3.5 |
Affected products
- Apache Software Foundation Apache jUDDI
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
References
-
issues.apache.org
/jira/browse/JUDDI-987
web, issue-tracking, patch, vendor-advisory
-
juddi.apache.org
/security.html
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2018-1307
advisory
-
github.com
/advisories/GHSA-p99p-726h-c8v5
advisory
Sources
- CVE List CVE-2018-1307
- GitHub Advisory GHSA-p99p-726h-c8v5
- NVD CVE-2018-1307
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.