← Vulnerability feed

Vulnerability record · CVE-2017-7545 · published 26 July 2018

CVE-2017-7545: Redhat decision manager xml external entity (xxe) vulnerability

Redhat · Decision Manager

It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXternal Entity (XXE) attacks.

6.5 CVSS 3.0 Medium EPSS 2.7% · top 14.2% CWE-611 · XML external entity (XXE)
6.5CVSS 3.0 base score, v2 4.0
2.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXternal Entity (XXE) attacks.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/102179 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:3354 Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3355 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7545 Issue TrackingPatchVendor Advisory
https://github.com/kiegroup/jbpm-designer/commit/a143f3b92a6a5a527d929d68c02a0c5d914ab81d PatchThird Party Advisory
http://www.securityfocus.com/bid/102179 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:3354 Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3355 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7545 Issue TrackingPatchVendor Advisory
https://github.com/kiegroup/jbpm-designer/commit/a143f3b92a6a5a527d929d68c02a0c5d914ab81d PatchThird Party Advisory

Track CVE-2017-7545 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed9.8CVE-2019-14892Fasterxml jackson-databind information exposure vulnerabilityA flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a mal…EPSS 5.6%9.8CVE-2018-19361Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from po…EPSS 11%9.8CVE-2018-19362Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core cla…EPSS 11%9.8CVE-2018-19360Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms c…EPSS 11%9.8CVE-2015-7501Red Hat JBoss Java deserialization allows remote command executionMultiple Red Hat JBoss products deserialize untrusted Java objects and, through the Apache Commons Collections library, allow remote attackers to exe…EPSS 86%analysed9.8CVE-2016-4999Redhat dashbuilder sql injection vulnerabilitySQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuil…EPSS 3.7%8.8CVE-2022-1415Redhat decision manager deserialization of untrusted data vulnerabilityA flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated a…EPSS 1.0%

Source: NIST National Vulnerability Database (record CVE-2017-7545), CISA KEV, FIRST EPSS (scores of 2026-10-12). This page is refreshed as NVD updates the record.