CVE-2019-1010202 describes an XML External Entity (XXE) vulnerability in Jeesite version 1.2.7, specifically within the convertToModel() function of the ActProcessService. This medium-severity vulnerability (CVSS 6.5) allows an authenticated attacker to achieve sensitive information disclosure by uploading a specially crafted XML file over the network. While the vulnerability is not known to be actively exploited and lacks public exploit code or significant community discussion, organizations using affected versions should upgrade to Jeesite 4.0 or later to mitigate the risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.2.7CPE matchmatch criteria | cpe:2.3:a:jeesite:jeesite:1.2.7:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.