CVE-2018-14383

Published: Aug 7, 2019Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The Transition Technologies "The Scheduler" app 5.1.3 for Jira allows XXE due to a weakly configured/parameterized XML parser. It was fixed in the versions 5.2.1 and 3.3.7

Affected (1)

Products: Ttpsc: The Scheduler

Ttpsc

1 product

The Scheduler

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ttpsc The Scheduler	Version 5.1.3

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (4)

https://marketplace.atlassian.com/apps/37456/the-scheduler?hosting=server&tab=versions

Source: cve@mitre.org

Third Party Advisory

https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-022_jira_plugin_the_scheduler.txt

Source: cve@mitre.org

Third Party Advisory

https://marketplace.atlassian.com/apps/37456/the-scheduler?hosting=server&tab=versions

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-022_jira_plugin_the_scheduler.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.