{"id":"CVE-2018-12471","aliases":["EUVD-2018-4441","GHSA-6gf8-cqw7-6g5f","SUSE-SU-2018:2898-1","SUSE-SU-2018:2898-2","SUSE-SU-2018:2899-1"],"status":"published","title":"External Entity processing in the RegistrationSharing module","description":"A External Entity Reference ('XXE') vulnerability in SUSE Linux SMT allows remote attackers to read data from the server or cause DoS by referencing blocking elements. Affected releases are SUSE Linux SMT: versions prior to 3.0.37.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01529,"percentile":0.74911,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-611"],"published":"2018-09-27T12:47:15Z","modified":"2026-06-17T01:37:50Z","affected":[{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"smt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.37-52.23.6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"perl-File-Touch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11-3.2.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"smt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.37-52.23.6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"smt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.37-52.23.6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"yast2-smt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-10.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"smt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.37-52.23.6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"smt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.37-52.23.6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"yast2-smt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-10.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"smt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.37-52.23.6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"smt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.37-52.23.6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"smt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.37-52.23.6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"smt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.37-52.23.6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"smt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.37-52.23.6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Subscription Management Tool 11 SP3","package":"smt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.34-50.8.1"}]}],"bundled":3}],"products":[{"vendor":"suse","product":"subscription_management_tool"},{"vendor":"suse linux","product":"smt"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1103809","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12471"},{"url":"https://github.com/advisories/GHSA-6gf8-cqw7-6g5f"},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182898-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1006984","tags":["report"]},{"url":"https://bugzilla.suse.com/1006989","tags":["report"]},{"url":"https://bugzilla.suse.com/1037811","tags":["report"]},{"url":"https://bugzilla.suse.com/1097560","tags":["report"]},{"url":"https://bugzilla.suse.com/1097824","tags":["report"]},{"url":"https://bugzilla.suse.com/1103809","tags":["report"]},{"url":"https://bugzilla.suse.com/1103810","tags":["report"]},{"url":"https://bugzilla.suse.com/1104076","tags":["report"]},{"url":"https://bugzilla.suse.com/977043","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12472","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182898-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182899-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1072921","tags":["report"]},{"url":"https://bugzilla.suse.com/1074608","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-12471","title":"External Entity processing in the RegistrationSharing module","description":"A External Entity Reference ('XXE') vulnerability in SUSE Linux SMT allows remote attackers to read data from the server or cause DoS by referencing blocking elements. Affected releases are SUSE Linux SMT: versions prior to 3.0.37.","status":"published","published":"2018-10-04T14:00:00Z","modified":"2024-09-17T01:50:45.119Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:35:06.320867Z"}],"euvd":[{"id":"EUVD-2018-4441","description":"A External Entity Reference ('XXE') vulnerability in SUSE Linux SMT allows remote attackers to read data from the server or cause DoS by referencing blocking elements. Affected releases are SUSE Linux SMT: versions prior to 3.0.37.","status":"published","published":"2018-10-04T14:00:00Z","modified":"2024-09-17T01:50:45Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:28:46.164413Z"}],"ghsa":[{"id":"GHSA-6gf8-cqw7-6g5f","title":"A External Entity Reference ('XXE') vulnerability in SUSE Linux SMT allows remote attackers to...","description":"A External Entity Reference ('XXE') vulnerability in SUSE Linux SMT allows remote attackers to read data from the server or cause DoS by referencing blocking elements. Affected releases are SUSE Linux SMT: versions prior to 3.0.37.","status":"published","published":"2022-05-13T01:34:46Z","modified":"2023-02-01T05:08:46Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:50:51.059157Z"}],"nvd":[{"id":"CVE-2018-12471","description":"A External Entity Reference ('XXE') vulnerability in SUSE Linux SMT allows remote attackers to read data from the server or cause DoS by referencing blocking elements. Affected releases are SUSE Linux SMT: versions prior to 3.0.37.","status":"published","published":"2018-10-04T14:29:00.547Z","modified":"2026-06-17T01:37:50.753Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:04:42.52179Z"}],"osv":[{"id":"SUSE-SU-2018:2898-1","title":"Security update for smt, yast2-smt","description":"This update for yast2-smt to 3.0.14 and smt to 3.0.37 fixes the following issues:\n\nThese security issues were fixed in SMT:\n\n- CVE-2018-12471: Xml External Entity processing in the RegistrationSharing\n  modules allowed to read arbitrary file read (bsc#1103809).\n- CVE-2018-12470: SQL injection in RegistrationSharing module allows remote\n  attackers to run arbitrary SQL statements (bsc#1103810).\n- CVE-2018-12472: Authentication bypass in sibling check facilitated further\n  attacks on SMT (bsc#1104076).\n\nSUSE would like to thank Jake Miller for reporting these issues to us.\n\nThese non-security issues were fixed in SMT:\n\n- Fix cron jobs randomization (bsc#1097560)\n- Fix duplicate migration paths (bsc#1097824)\n\nThis non-security issue was fixed in yast2-smt:\n\n- Remove cron job rescheduling (bsc#1097560)\n- Added missing translation marks (bsc#1037811)\n- Explicitly mention 'Organization Credentials' (fate#321759)\n- Rearrange the SMT set-up dialog (bsc#977043)\n- Make the Filter button default (bsc#1006984)\n- Prevent exiting the repo selection dialog via hitting Enter in\n  the repository filter (bsc#1006984)\n- report when error occurs during repo mirroring (bsc#1006989)\n- Use TextEntry-based filter for repos (fate#319777)\n","status":"published","published":"2018-09-27T12:47:15Z","modified":"2026-02-04T03:15:44.699231Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2898-2","title":"Security update for smt, yast2-smt","description":"This update for yast2-smt to 3.0.14 and smt to 3.0.37 fixes the following issues:\n\nThese security issues were fixed in SMT:\n\n- CVE-2018-12471: Xml External Entity processing in the RegistrationSharing\n  modules allowed to read arbitrary file read (bsc#1103809).\n- CVE-2018-12470: SQL injection in RegistrationSharing module allows remote\n  attackers to run arbitrary SQL statements (bsc#1103810).\n- CVE-2018-12472: Authentication bypass in sibling check facilitated further\n  attacks on SMT (bsc#1104076).\n\nSUSE would like to thank Jake Miller for reporting these issues to us.\n\nThese non-security issues were fixed in SMT:\n\n- Fix cron jobs randomization (bsc#1097560)\n- Fix duplicate migration paths (bsc#1097824)\n\nThis non-security issue was fixed in yast2-smt:\n\n- Remove cron job rescheduling (bsc#1097560)\n- Added missing translation marks (bsc#1037811)\n- Explicitly mention 'Organization Credentials' (fate#321759)\n- Rearrange the SMT set-up dialog (bsc#977043)\n- Make the Filter button default (bsc#1006984)\n- Prevent exiting the repo selection dialog via hitting Enter in\n  the repository filter (bsc#1006984)\n- report when error occurs during repo mirroring (bsc#1006989)\n- Use TextEntry-based filter for repos (fate#319777)\n","status":"published","published":"2018-10-18T12:49:39Z","modified":"2026-02-04T03:19:54.88764Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2899-1","title":"Security update for smt","description":"This update for smt to 2.0.34 fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2018-12471: Xml External Entity processing in the RegistrationSharing\n  modules allowed to read arbitrary file read (bsc#1103809)\n- CVE-2018-12470: SQL injection in RegistrationSharing module allows remote\n  attackers to run arbitary SQL statements (bsc#1103810)\n- CVE-2018-12472: Authentication bypass in sibling check facilitated further\n  attacks on SMT (bsc#1104076)\n\nSUSE would like to thank Jake Miller for reporting these issues to us.\n\nThis non-security issue was fixed:\n\n- More verbose incomplete registration logging (bsc#1072921, bsc#1074608)\n","status":"published","published":"2018-09-27T12:47:25Z","modified":"2026-02-04T04:25:07.251665Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}