{"api_version":"1","generated_at":"2026-07-23T08:01:15+00:00","cve":"CVE-2018-0486","urls":{"html":"https://cve.report/CVE-2018-0486","api":"https://cve.report/api/cve/CVE-2018-0486.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-0486","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-0486"},"summary":{"title":"CVE-2018-0486","description":"Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.","state":"PUBLIC","assigner":"security@debian.org","published_at":"2018-01-13 18:29:00","updated_at":"2018-02-15 18:24:00"},"problem_types":["CWE-347"],"metrics":[],"references":[{"url":"https://shibboleth.net/community/advisories/secadv_20180112.txt","name":"https://shibboleth.net/community/advisories/secadv_20180112.txt","refsource":"MISC","tags":["Vendor Advisory"],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.debian.org/debian-security-announce/2018/msg00007.html","name":"https://lists.debian.org/debian-security-announce/2018/msg00007.html","refsource":"MISC","tags":["Mailing List","Third Party Advisory"],"title":"[SECURITY] [DSA 4085-1] xmltooling security update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1040177","name":"1040177","refsource":"SECTRACK","tags":["Third Party Advisory","VDB Entry"],"title":"Shibboleth Service Provider Lets Remote Users Modify User Attribute Data on the Target System - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.debian.org/debian-lts-announce/2018/01/msg00016.html","name":"[debian-lts-announce] 20180114 [SECURITY] [DLA 1242-1] xmltooling security update","refsource":"MLIST","tags":["Mailing List","Third Party Advisory"],"title":"[SECURITY] [DLA 1242-1] xmltooling security update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.debian.org/security/2018/dsa-4085","name":"DSA-4085","refsource":"DEBIAN","tags":["Third Party Advisory"],"title":"Debian -- Security Information -- DSA-4085-1 xmltooling","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-0486","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-0486","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"486","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"486","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"486","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"486","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"486","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"486","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"486","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"shibboleth","cpe5":"xmltooling-c","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"486","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"shibboleth","cpe5":"xmltooling-c","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@debian.org","ID":"CVE-2018-0486","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"XMLTooling-C before 1.6.3","version":{"version_data":[{"version_value":"XMLTooling-C before 1.6.3"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"mishandles digital signatures"}]}]},"references":{"reference_data":[{"name":"DSA-4085","refsource":"DEBIAN","url":"https://www.debian.org/security/2018/dsa-4085"},{"name":"https://lists.debian.org/debian-security-announce/2018/msg00007.html","refsource":"MISC","url":"https://lists.debian.org/debian-security-announce/2018/msg00007.html"},{"name":"https://shibboleth.net/community/advisories/secadv_20180112.txt","refsource":"MISC","url":"https://shibboleth.net/community/advisories/secadv_20180112.txt"},{"name":"[debian-lts-announce] 20180114 [SECURITY] [DLA 1242-1] xmltooling security update","refsource":"MLIST","url":"https://lists.debian.org/debian-lts-announce/2018/01/msg00016.html"},{"name":"1040177","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1040177"}]}},"nvd":{"publishedDate":"2018-01-13 18:29:00","lastModifiedDate":"2018-02-15 18:24:00","problem_types":["CWE-347"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":3.9,"impactScore":2.5},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":6.4},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":4.9,"acInsufInfo":true,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:shibboleth:xmltooling-c:*:*:*:*:*:*:*:*","versionEndExcluding":"1.6.3","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"486","Ordinal":"115321","Title":"CVE-2018-0486","CVE":"CVE-2018-0486","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"486","Ordinal":"1","NoteData":"Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"486","Ordinal":"2","NoteData":"2018-01-13","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"486","Ordinal":"3","NoteData":"2018-02-02","Type":"Other","Title":"Modified"}]}}}