{"cve":"CVE-2018-11758","nvd":{"published":"2018-08-22T20:29:00.240","modified":"2026-06-17T01:36:31.443","status":"Modified","description":"This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2. CayenneModeler is a desktop GUI tool shipped with Apache Cayenne and intended for editing Cayenne ORM models stored as XML files. If an attacker tricks a user of CayenneModeler into opening a malicious XML file, the attacker will be able to instruct the XML parser built into CayenneModeler to transfer files from a local machine to a remote machine controlled by the attacker. The cause of the issue is XML parser processing XML External Entity (XXE) declarations included in XML. The vulnerability is addressed in Cayenne by disabling XXE processing in all operations that require XML parsing.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","score":8.1},"cwes":["CWE-611"],"references":["http://www.securityfocus.com/bid/105142","https://lists.apache.org/thread.html/ed60a4d329be3c722f105317ca883986dfcd17615c70d1df87f4528c%40%3Cuser.cayenne.apache.org%3E","http://www.securityfocus.com/bid/105142","https://lists.apache.org/thread.html/ed60a4d329be3c722f105317ca883986dfcd17615c70d1df87f4528c%40%3Cuser.cayenne.apache.org%3E"],"products":["apache:cayenne"],"source":"nvd","synced_at":"2026-10-19T20:52:03.425131697+00:00"},"epss":{"cve":"CVE-2018-11758","score":0.02936,"percentile":0.87102,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-85hw-w436-c725","url":"https://osv.dev/vulnerability/GHSA-85hw-w436-c725","summary":"XML External Entity Reference in Apache Cayenne","modified":"2023-11-08T03:59:46.699527Z","packages":[{"ecosystem":"Maven","name":"org.apache.cayenne:cayenne-parent","purl":"pkg:maven/org.apache.cayenne/cayenne-parent","ranges":["<3.1.3"],"fixed":["3.1.3"]},{"ecosystem":"Maven","name":"org.apache.cayenne:cayenne-parent","purl":"pkg:maven/org.apache.cayenne/cayenne-parent","ranges":[">=4.0 <4.1"],"fixed":["4.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}