Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-11761

CVE-2018-11761: High severity vulnerability that affects org.apache.tika:tika-core

7.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2018-11761
GHSA ID
GHSA-6jq2-789q-fff2
EPSS Score
0.93834%
CWE
CWE-611
Published
10/17/2018
Updated
1/9/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.tika:tika-coremaven>= 0.1, < 1.19.11.19.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from unconfigured XML parsers allowing unlimited entity expansion. The patches show critical replacements of DocumentBuilder.parse() calls with secure buildDOM() methods that enforce entity limits. The TikaConfig constructors were directly modified to remove vulnerable parsing methods, indicating these entry points previously used insecure configurations. XMLReaderUtils.getDocumentBuilder() is identified as the source of unsecured DocumentBuilder instances before the patch added entity limit controls.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

In *p**** Tik* *.* to *.**, t** XML p*rs*rs w*r* not *on*i*ur** to limit *ntity *xp*nsion. T**y w*r* t**r**or* vuln*r**l* to *n *ntity *xp*nsion vuln*r**ility w*i** **n l*** to * **ni*l o* s*rvi** *tt**k.

Reasoning

T** vuln*r**ility st*mm** *rom un*on*i*ur** XML p*rs*rs *llowin* unlimit** *ntity *xp*nsion. T** p*t***s s*ow *riti**l r*pl***m*nts o* `*o*um*nt*uil**r.p*rs*()` **lls wit* s**ur* `*uil**OM()` m*t*o*s t**t *n*or** *ntity limits. T** `Tik**on*i*` *onst