CVE-2024-22218
Published: 15 August 2024
Summary
CVE-2024-22218 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 9.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2024-22218 is an XML External Entity (XXE) flaw, tracked under CWE-611, that affects Terminalfour versions 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4. It received a CVSS 3.1 score of 8.8 reflecting network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability when exploited.
Authenticated users can submit malicious XML via unspecified features to trigger the XXE condition. Depending on the payload and environment, this can result in access to the underlying server file system, remote code execution, or Server-Side Request Forgery attacks against internal or external resources.
Terminalfour has published security notices and release-note highlights that address CVE-2024-22218 and the related CVE-2024-22219, directing customers to updated builds and configuration guidance. The associated EPSS score has remained flat at 0.0554 with no material rise since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19794
Vulnerability details
XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying server, remote…
more
code execution (RCE), or performing Server-Side Request Forgery (SSRF) attacks.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.