Apache Wink up to 1.1.1 XML Document xml external entity reference

Summaryinfo

A vulnerability marked as critical has been reported in Apache Wink up to 1.1.1. Affected is an unknown function of the component XML Document Handler. This manipulation causes xml external entity reference. This vulnerability appears as CVE-2010-2245. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Apache Wink up to 1.1.1. It has been declared as critical. Affected by this vulnerability is an unknown code of the component XML Document Handler. The manipulation with an unknown input leads to a xml external entity reference vulnerability. The CWE definition for the vulnerability is CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. As an impact it is known to affect confidentiality, and availability. The summary by CVE is:

XML External Entity (XXE) vulnerability in Apache Wink 1.1.1 and earlier allows remote attackers to read arbitrary files or cause a denial of service via a crafted XML document.

The bug was discovered 06/09/2010. The weakness was presented 08/08/2017 (Website). It is possible to read the advisory at marc.info. This vulnerability is known as CVE-2010-2245 since 06/09/2010. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 10/01/2025).

The vulnerability was handled as a non-public zero-day exploit for at least 2617 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-2154). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• IBM InfoSphere Information Server

Productinfo

Vendor

• Apache

Name

• Wink

Version

• 1.1.0
• 1.1.1

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion