Read the docs
TI-2018-08415 Aliases CVE-2018-11758GHSA-85hw-w436-c725

XML external entity injection in Apache Cayenne

Priority MEDIUM 41CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2. CayenneModeler is a desktop GUI tool shipped with Apache Cayenne and intended for editing Cayenne ORM models stored as XML files. If an attacker tricks a user of CayenneModeler into opening a malicious XML file, the attacker will be able to instruct the XML parser built into CayenneModeler to transfer files from a local machine to a remote machine controlled by the attacker. The cause of the issue is XML parser processing XML External Entity (XXE) declarations included in XML. The vulnerability is addressed in Cayenne by disabling XXE processing in all operations that require XML parsing.

Why it matters now

EPSS 0.02936 87th percentileScored 2026-11-07
Fix Fixed org.apache.cayenne:cayenne-parent (Maven): 3.1.3, 4.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Cayenne4.1.M1; 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1; 3.1, 3.1.1, 3.1.2—No fix listedCNA
—org.apache.cayenne:cayenne-parent (Maven)before 3.1.33.1.3Patch availableGHSA-85hw-w436-c725
—org.apache.cayenne:cayenne-parent (Maven)4.0 to before 4.14.1Patch availableGHSA-85hw-w436-c725
  • Apache Cayenne VendorApache Affected 4.1.M1; 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1; 3.1, 3.1.1, 3.1.2 Fixed in — No fix listed CNA
  • org.apache.cayenne:cayenne-parent (Maven) Vendor— Affected before 3.1.3 Fixed in 3.1.3 Patch available GHSA-85hw-w436-c725
  • org.apache.cayenne:cayenne-parent (Maven) Vendor— Affected 4.0 to before 4.1 Fixed in 4.1 Patch available GHSA-85hw-w436-c725

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:apache:cayenne:*:*:*:*:*:*:*:*up to 3.1.0VulnerableApache
cpe:2.3:a:apache:cayenne:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableApache
cpe:2.3:a:apache:cayenne:3.1.2:*:*:*:*:*:*:*3.1.2VulnerableApache
cpe:2.3:a:apache:cayenne:3.2:milestone1:*:*:*:*:*:*3.2 milestone1VulnerableApache
cpe:2.3:a:apache:cayenne:4.0:beta1:*:*:*:*:*:*4.0 beta1VulnerableApache
cpe:2.3:a:apache:cayenne:4.0:beta2:*:*:*:*:*:*4.0 beta2VulnerableApache
cpe:2.3:a:apache:cayenne:4.0:milestone2:*:*:*:*:*:*4.0 milestone2VulnerableApache
cpe:2.3:a:apache:cayenne:4.0:milestone3:*:*:*:*:*:*4.0 milestone3VulnerableApache
cpe:2.3:a:apache:cayenne:4.0:milestone4:*:*:*:*:*:*4.0 milestone4VulnerableApache
cpe:2.3:a:apache:cayenne:4.0:milestone5:*:*:*:*:*:*4.0 milestone5VulnerableApache
  • cpe:2.3:a:apache:cayenne:*:*:*:*:*:*:*:* Versions up to 3.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:cayenne:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:cayenne:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:cayenne:3.2:milestone1:*:*:*:*:*:* Versions 3.2 milestone1 Vulnerable ·Apache
  • cpe:2.3:a:apache:cayenne:4.0:beta1:*:*:*:*:*:* Versions 4.0 beta1 Vulnerable ·Apache
  • cpe:2.3:a:apache:cayenne:4.0:beta2:*:*:*:*:*:* Versions 4.0 beta2 Vulnerable ·Apache
  • cpe:2.3:a:apache:cayenne:4.0:milestone2:*:*:*:*:*:* Versions 4.0 milestone2 Vulnerable ·Apache
  • cpe:2.3:a:apache:cayenne:4.0:milestone3:*:*:*:*:*:* Versions 4.0 milestone3 Vulnerable ·Apache
  • cpe:2.3:a:apache:cayenne:4.0:milestone4:*:*:*:*:*:* Versions 4.0 milestone4 Vulnerable ·Apache
  • cpe:2.3:a:apache:cayenne:4.0:milestone5:*:*:*:*:*:* Versions 4.0 milestone5 Vulnerable ·Apache
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:cayenne:4.0:rc1:*:*:*:*:*:*4.0 rc1VulnerableApache
cpe:2.3:a:apache:cayenne:4.1:milestone1:*:*:*:*:*:*4.1 milestone1VulnerableApache
  • cpe:2.3:a:apache:cayenne:4.0:rc1:*:*:*:*:*:* Versions 4.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:cayenne:4.1:milestone1:*:*:*:*:*:* Versions 4.1 milestone1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-85hw-w436-c725 org.apache.cayenne:cayenne-parent (Maven) Fixed in 3.1.3 Advisory →
  • Fix · GHSA-85hw-w436-c725 org.apache.cayenne:cayenne-parent (Maven) Fixed in 4.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-11758
  2. 2026-10-03 Alias added: GHSA-85hw-w436-c725

References

Advisory 1

Other 2

  • TI-2022-08170 Deserialization of untrusted data in the Hessian Component of Apache Cayenne 4.1 with older Java versions CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences