CVE-2026-18061

Katalog CVE

CVSS 5.9 · Medium EPSS 0,27%

Kerentanan Improper Restriction of XML External Entity Reference pada amazon advanced jdbc wrapper. Skor CVSS 3.1 5.9 (Medium) menurut CNA.

Deskripsi (NVD)

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including stored database and IAM role credentials, via crafted XML data in a cached column value. To remediate this issue, users should upgrade to version 4.3.0 or later.

Rincian

Terbit di NVD

11 September 2026

Terakhir diubah

16 September 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber CNA
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://aws.amazon.com/security/security-bulletins/2026-109-aws/ patch · advisory vendor
• https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.3.0 release notes · advisory vendor
• https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-fpvp-qwgm-v6h9 advisory vendor