Mageni Mageni Security LLC

Free and open-source vulnerability scanner

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

CVE-2019-0228

CVE information

Published

5 years ago

Last Modified

5 months ago

CVSSv2.0 Severity

High

CVSSv3.1 Severity

Critical

Impact Analysis

Share

Description

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF..

CVSSv2.0 Score

Severity
High
Base Score
7.5/10
Exploit Score
10/10
Access Vector
Network
Access Complexity
Low
Authentication Required
None
Impact Score
6.4/10
Confidentiality Impact
Partial
Availability Impact
Partial
Integrity Impact
Partial

CVSSv3.1 Score

Severity
Critical
Base Score
9.8/10
Exploit Score
3.9/10
Access Vector
Network
Access Complexity
Low
Privileges Required
None
Impact Score
5.9/10
Confidentiality Impact
High
Availability Impact
High
Integrity Impact
High
Scope
Unchanged
User Interaction
None

Products Affected

CPE Affected Vulnerable Excluding Edit
cpe:2.3:a:apache:pdfbox:2.0.14:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:apache:james:3.4.0:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:apache:james:3.3.0:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:hyperion_financial_reporting:11.1.2.4:*:*:*
  Yes
- -
cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:
  Yes
- -
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*
  Yes
- -
cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:
  Yes
- -
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*
  Yes
- -
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*
  Yes
- -
cpe:2.3:a:oracle:hyperion_financial_reporting:11.2.6.0:*:*:*
  Yes
- -
cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:banking_trade_finance_process_management:14
  Yes
- -
cpe:2.3:a:oracle:banking_trade_finance_process_management:14
  Yes
- -
cpe:2.3:a:oracle:banking_trade_finance_process_management:14
  Yes
- -
cpe:2.3:a:oracle:banking_credit_facilities_process_managemen
  Yes
- -
cpe:2.3:a:oracle:banking_credit_facilities_process_managemen
  Yes
- -
cpe:2.3:a:oracle:banking_credit_facilities_process_managemen
  Yes
- -
cpe:2.3:a:oracle:banking_corporate_lending_process_managemen
  Yes
- -
cpe:2.3:a:oracle:banking_corporate_lending_process_managemen
  Yes
- -
cpe:2.3:a:oracle:banking_corporate_lending_process_managemen
  Yes
- -
cpe:2.3:a:oracle:banking_supply_chain_finance:14.2:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:banking_supply_chain_finance:14.3:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*
  Yes
- -
cpe:2.3:a:oracle:banking_virtual_account_management:14.2:*:*
  Yes
- -
cpe:2.3:a:oracle:banking_virtual_account_management:14.5:*:*
  Yes
- -
cpe:2.3:a:oracle:communications_session_report_manager:*:*:*
  Yes
8.0.0.0 -

References