VULNERABILITY INTELLIGENCE
CVE-2018-8038
CVSS score7.5 HIGH
EPSS probability10.60%
CISA KEVNot currently listed
Published2018-07-05
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the application plugins, or in the Identity Provider itself when parsing certain XML-based parameters.
Weakness classification
- CWE-20: Improper Input Validation
Primary references
- security@apache.org — Vendor Advisory
- security@apache.org — Third Party Advisory, VDB Entry
- security@apache.org — Patch, Third Party Advisory
- security@apache.org
- security@apache.org
- security@apache.org
- security@apache.org
- security@apache.org
- security@apache.org
- security@apache.org
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry