Eclipse RDF4J vulnerabilities

2 CVEs affecting Eclipse RDF4J, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-20227, published 2018-12-19.

More from Eclipse.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-20227, published 2018-12-19. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.
• CVE-2018-1000644, published 2018-08-20. Critical severity, CVSS 10.0. EPSS: 1.7% chance of exploitation in the next 30 days. Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of…