CVE-2018-17289

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-04-18 · updated 2026-06-17
Weakness: CWE-611

Description

An XML external entity (XXE) vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to read arbitrary files via crafted XML inside an imported package configuration (.ZIP file) within the Kofax/KFS/Admin/PackageService/package/upload file parameter.

Affected products

Kofax Front Office Server: 4.1.1.11.0.5212

References

https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17289-XXE-Kofax
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17289-XXE-Kofax

Get alerted when CVE-2018-17289 or the next vulnerability affects your stack