CVE-2018-20000

    Dashboard / Vulnerabilities / CVE-2018-20000

    CVE-2018-20000

    Published: 10 Dec 2018Last Modified: 8 Jul 2026

    Summary:

    Details: Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java.

    References: https://github.com/Bedework/bw-webdav/compare/bw-webdav-4.0.2...bw-webdav-4.0.3, https://github.com/Bedework/bw-webdav/pull/1

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -72daff7601766346a29f8f5183e226b4996ee897

    Affected versions

    bw-webdav-4.0.2
    bw-webdav-4.0.1
    bw-webdav-4.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High