How severe is CVE-2017-7545?

CVE-2017-7545 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2017-7545 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (84th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-7545?

CVE-2017-7545 primarily affects Redhat Decision Manager. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2017-7545?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2017-7545 published?

CVE-2017-7545 was published on 2018-07-26 and last updated on 2026-06-17.

CVE-2017-7545

CVE-2017-7545 is a medium-severity vulnerability in Redhat Decision Manager with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-611.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 4.0
EPSS exploit prediction: 3% (84th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-611
Affected product: Redhat Decision Manager
Published: 2018-07-26
Last modified: 2026-06-17

Description

It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXternal Entity (XXE) attacks.

Frequently asked questions

What is CVE-2017-7545?: It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXternal Entity (XXE) attacks.
How severe is CVE-2017-7545?: CVE-2017-7545 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2017-7545 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (84th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-7545?: CVE-2017-7545 primarily affects Redhat Decision Manager. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2017-7545?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2017-7545 published?: CVE-2017-7545 was published on 2018-07-26 and last updated on 2026-06-17.

References

Affected products (3)

cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_bpm_suite:6.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jbpm:6.5:*:*:*:*:*:*:*

More vulnerabilities in Redhat Decision Manager

CVE-2019-14892 — Critical (CVSS 9.8): A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit…
CVE-2018-19362 — Critical (CVSS 9.8): FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to…
CVE-2018-19361 — Critical (CVSS 9.8): FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to…
CVE-2018-19360 — Critical (CVSS 9.8): FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to…
CVE-2019-14841 — High (CVSS 8.8): A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header.…
CVE-2020-1714 — High (CVSS 8.8): A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without…

All CVEs affecting Redhat Decision Manager →

Other CWE-611 (Improper Restriction of XML External Entity Reference (XXE)) vulnerabilities

CVE-2022-22486 — Critical (CVSS 10.0): IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when…
CVE-2019-14678 — Critical (CVSS 10.0): SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in…
CVE-2015-9280 — Critical (CVSS 10.0): MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.
CVE-2018-1000838 — Critical (CVSS 10.0): autopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result…
CVE-2018-1000837 — Critical (CVSS 10.0): UML Designer version <= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can…
CVE-2018-1000835 — Critical (CVSS 10.0): KeePassDX version <= 2.5.0.0beta17 contains a XML External Entity (XXE) vulnerability in kdbx file parser that can…

Browse all CWE-611 (Improper Restriction of XML External Entity Reference (XXE)) vulnerabilities →