Cyber Resilience

CVE-2024-22218

High

Published: 15 August 2024

Published
15 August 2024
Modified
15 April 2026
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0554 90.5th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-22218 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 9.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

The vulnerability CVE-2024-22218 is an XML External Entity (XXE) flaw, tracked under CWE-611, that affects Terminalfour versions 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4. It received a CVSS 3.1 score of 8.8 reflecting network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability when exploited.

Authenticated users can submit malicious XML via unspecified features to trigger the XXE condition. Depending on the payload and environment, this can result in access to the underlying server file system, remote code execution, or Server-Side Request Forgery attacks against internal or external resources.

Terminalfour has published security notices and release-note highlights that address CVE-2024-22218 and the related CVE-2024-22219, directing customers to updated builds and configuration guidance. The associated EPSS score has remained flat at 0.0554 with no material rise since disclosure.

EU & UK References

Vulnerability details

XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying server, remote…

more

code execution (RCE), or performing Server-Side Request Forgery (SSRF) attacks.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

XML JDBC
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-611

Penetration testing includes XML external entity payloads, detecting XXE vulnerabilities and enabling their mitigation.

addresses: CWE-611

Identifies XML external entity processing via monitoring of unusual file/network access or resource usage.

References