CVE-2017-7545: Red Hat Decision Manager

Medium severity, CVSS 6.5. EPSS: 2.7% chance of exploitation in the next 30 days.

It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXternal Entity (XXE) attacks.

Affected products

• Red Hat Decision Manager: version 7.0 only
• Red Hat JBoss Bpm Suite: version 6.4 only
• Red Hat Jbpm: version 6.5 only

Published 2018-07-26. Last modified 2026-06-17.