CVE-2018-17198
Quick assessment
Affected
Apache Software Foundation Apache Roller
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Roller是美国阿帕奇（Apache）软件基金会的一套基于Java的多用户开源博客系统。 Apache Roller 5.2.1版本、5.2.0和之前不再支持的老版本中存在代码问题漏洞。该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2018-17198
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser to implement its XML-RPC interface and by default that parser supports external entities in XML DOCTYPE, which opens Roller up to SSRF / File Enumeration vulnerability. Note that this vulnerability exists even if Roller XML-RPC interface is disable via the Roller web admin UI. Mitigation: There are a couple of ways you can fix this vulnerability: 1) Upgrade to the latest version of Roller, which is now 5.2.2 2) Or, edit the Roller web.xml file and comment out the XML-RPC Servlet mapping as shown below: <!-- <servlet-mapping> <servlet-name>XmlRpcServlet</servlet-name> <url-pattern>/roller-services/xmlrpc</url-pattern> </servlet-mapping> -->
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Roller 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Roller是美国阿帕奇（Apache）软件基金会的一套基于Java的多用户开源博客系统。 Apache Roller 5.2.1版本、5.2.0和之前不再支持的老版本中存在代码问题漏洞。该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Roller | 5.2.1 | - |
|
II. Public POCs for CVE-2018-17198
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-17198
请登录查看更多情报信息。
Vendor Advisories for CVE-2018-17198 (1)
Mailing List Discussions for CVE-2018-17198 (1)
IV. Related Vulnerabilities
Same product: Apache Roller
-
CVE-2025-24859
Apache Roller: Insufficient Session Expiration on Password C -
CVE-2024-46911
Apache Roller: Weakness in CSRF protection allows privilege -
CVE-2024-25090
Apache Roller: Insufficient input validation for some user p -
CVE-2023-37581
Apache Roller: Roller's weblog category, weblog settings and -
CVE-2021-33580
regex injection leading to DoS
Same vendor: Apache Software Foundation
-
CVE-2026-59654
Apache CloudStack: DoS caused by database connections leak -
CVE-2026-63046
Apache InLong: Agent Installer — Command Injection to RCE vi -
CVE-2026-47359
Apache CloudStack: OS Command Injection due to unsanitized m -
CVE-2026-50112
Apache CloudStack: RCE and SSRF in direct download, metalink -
CVE-2026-50222
Apache CloudStack: Improper access control in Userdata refer
V. Comments for CVE-2018-17198
No comments yet