CVE-2018-13439 is an XML External Entity (XXE) vulnerability affecting the WXPayUtil component of the WeChat Pay Java SDK. This flaw allows attackers to exploit merchant notification URLs, potentially leading to information disclosure. Rated 7.5 HIGH on the CVSS scale, it presents a low-complexity network-based attack that could result in high confidentiality impact without requiring user interaction or privileges. While no public exploits, Metasploit modules, or Nuclei templates are available, and there is minimal community discussion or media coverage, organizations using the affected SDK should still address this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:tencent:wechat_pay:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.