Is CVE-2019-12400 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 1%.

What products does CVE-2019-12400 affect?

Tracked products affected include JBoss. Check the version you run to see whether it is affected.

How do I fix CVE-2019-12400?

Apply the vendor fix in your normal patch cycle. Upgrade affected products to a fixed version.

CVE-2019-12400

Q: What is CVE-2019-12400?

CVE-2019-12400 is a medium-severity software vulnerability (Improper input validation) with a CVSS score of 5.5. In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementat

MEDIUM severity · CVSS 5.5 · Improper input validation

5.5CVSS MEDIUM

Summary

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.

Impact & exploitability

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionNone

Confidentiality impactNone

Integrity impactHigh

Availability impactNone

Exploit probability (EPSS)1%

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected products we track (1)

JBoss

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

CVE-2019-12400

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information