ByteOS Network

Vulnerability Details :

CVE-2017-9362

Summary

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-25 Mar, 2019 | 15:54

Updated At-05 Aug, 2024 | 17:02

ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:25 Mar, 2019 | 15:54

Updated At:05 Aug, 2024 | 17:02

▼CVE Numbering Authority (CNA)

ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://labs.integrity.pt/advisories/cve-2017-9362	x_refsource_MISC

Hyperlink: https://labs.integrity.pt/advisories/cve-2017-9362

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://labs.integrity.pt/advisories/cve-2017-9362	x_refsource_MISC x_transferred

Hyperlink: https://labs.integrity.pt/advisories/cve-2017-9362

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:25 Mar, 2019 | 16:29

Updated At:02 Apr, 2019 | 12:53

ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P

Type: Primary

Version: 3.0

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 6.5

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:S/C:P/I:P/A:P

CPE Matches

Zoho Corporation Pvt. Ltd.

>>manageengine_servicedesk_plus>>Versions before 9.3(exclusive)

cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-611	Primary	nvd@nist.gov

CWE ID: CWE-611

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://labs.integrity.pt/advisories/cve-2017-9362	cve@mitre.org	Exploit Vendor Advisory

Hyperlink: https://labs.integrity.pt/advisories/cve-2017-9362

Source: cve@mitre.org

Resource:

Exploit

Vendor Advisory

Similar CVEs

106Records found

CVE-2018-1000009

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-0.07% / 20.28%

7 Day CHG~0.00%

Published-23 Jan, 2018 | 14:00

Updated-16 Sep, 2024 | 23:16

Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

Vendor-n/a Jenkins

Product-checkstyle n/a

CWE ID-CWE-611

Improper Restriction of XML External Entity Reference

CVE-2017-8913

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-0.55% / 68.44%

7 Day CHG~0.00%

Published-23 May, 2017 | 03:56

Updated-13 May, 2026 | 00:24

The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security Note 2386873.

Vendor-n/a SAP SE

Product-netweaver_application_server_java n/a

CWE ID-CWE-611

Improper Restriction of XML External Entity Reference

CVE-2021-38584

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.2||HIGH

EPSS-0.58% / 69.25%

7 Day CHG~0.00%

Published-11 Aug, 2021 | 22:56

Updated-04 Aug, 2024 | 01:44

The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).

Vendor-n/a cPanel (WebPros International, LLC)

Product-cpanel n/a

CWE ID-CWE-611

Improper Restriction of XML External Entity Reference

CVE-2025-13209

Matching Score-4

Assigner-VulDB

View Details

Matching Score-4

Assigner-VulDB

CVSS Score-5.3||MEDIUM

EPSS-0.03% / 10.45%

7 Day CHG~0.00%

Published-15 Nov, 2025 | 18:32

Updated-18 Nov, 2025 | 14:06

bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference

A weakness has been identified in bestfeng oa_git_free up to 9.5. This affects the function updateWriteBack of the file yimioa-oa9.5\server\c-flow\src\main\java\com\cloudweb\oa\controller\WorkflowPredefineController.java. This manipulation of the argument writeProp causes xml external entity reference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.

Vendor-bestfeng

Product-oa_git_free

CWE ID-CWE-610

Externally Controlled Reference to a Resource in Another Sphere

CWE ID-CWE-611

Improper Restriction of XML External Entity Reference

CVE-2025-1225

Matching Score-4

Assigner-VulDB

View Details

Matching Score-4

Assigner-VulDB

CVSS Score-5.3||MEDIUM

EPSS-0.30% / 54.07%

7 Day CHG~0.00%

Published-12 Feb, 2025 | 20:00

Updated-26 Aug, 2025 | 18:39

ywoa WXCallBack Interface XMLParse.java extract xml external entity reference

A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java of the component WXCallBack Interface. The manipulation leads to xml external entity reference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.

Vendor-r1bbit n/a

Product-yimioa ywoa

CWE ID-CWE-610

Externally Controlled Reference to a Resource in Another Sphere

CWE ID-CWE-611

Improper Restriction of XML External Entity Reference

CVE-2020-2092

Matching Score-4

Assigner-Jenkins Project

View Details

Matching Score-4

Assigner-Jenkins Project

CVSS Score-8.8||HIGH

EPSS-0.15% / 34.86%

7 Day CHG~0.00%

Published-15 Jan, 2020 | 15:15

Updated-04 Aug, 2024 | 06:54

Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents.

Vendor-Jenkins

Product-robot_framework Jenkins Robot Framework Plugin

CWE ID-CWE-611

Improper Restriction of XML External Entity Reference

CVE-2017-9362

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs