« Volver al listado

CVE-2024-22218

Estado: AplazadaAlta (8.8)—

XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying server, remote code execution (RCE), or performing Server-Side Request Forgery (SSRF) attacks.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Terminalfour — TerminalfourAIXML Jdbc — XML JdbcAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-22218",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-22218",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-15T18:22:35.475721Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:terminalfour:xml_jdbc:*:*:*:*:*:*:*:*"
          ],
          "vendor": "terminalfour",
          "product": "xml_jdbc",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "1.0.4"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:terminalfour:terminalfour:*:*:*:*:*:*:*:*"
          ],
          "vendor": "terminalfour",
          "product": "terminalfour",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0001",
              "versionType": "custom",
              "lessThanOrEqual": "8.3.18"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-15T18:15:19.197",
  "references": [
    {
      "url": "https://docs.terminalfour.com/articles/release-notes-highlights/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22218--cve-2024-22219/",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying server, remote code execution (RCE), or performing Server-Side Request Forgery (SSRF) attacks."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de entidad externa XML (XXE) en Terminalfour 8.0.0001 a 8.3.18 y versiones XML JDBC hasta 1.0.4 permite a usuarios autenticados enviar XML malicioso a través de funciones no especificadas que podrían conducir a diversas acciones, como acceder al servidor subyacente, código remoto ejecución (RCE) o realizar ataques de Server-Side Request Forgery (SSRF)."
    }
  ],
  "lastModified": "2026-06-17T07:10:57.823",
  "sourceIdentifier": "cve@mitre.org"
}