{"id":"CVE-2018-15531","details":"JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.","aliases":["GHSA-6fvx-r7hx-3vh6"],"modified":"2026-07-08T17:15:40.872732Z","published":"2018-09-26T22:29:00.590Z","references":[{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2018/09/25/3"},{"type":"ADVISORY","url":"https://github.com/javamelody/javamelody/wiki/ReleaseNotes"},{"type":"ADVISORY","url":"https://jenkins.io/security/advisory/2018-09-25/"},{"type":"FIX","url":"https://github.com/javamelody/javamelody/commit/ef111822562d0b9365bd3e671a75b65bd0613353"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/javamelody/javamelody","events":[{"introduced":"0"},{"fixed":"f3a12ae1b0f1d44420c0753dd9f15a91c1fe4861"},{"fixed":"ef111822562d0b9365bd3e671a75b65bd0613353"}],"database_specific":{"cpe":"cpe:2.3:a:javamelody_project:javamelody:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.74.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["javamelody-core-1.73.1","javamelody-core-1.73.0","javamelody-core-1.72.0","javamelody-core-1.71.0","javamelody-core-1.70.0","javamelody-core-1.69.0","javamelody-core-1.68.1","javamelody-core-1.68.0","javamelody-core-1.67.0","javamelody-core-1.66.0","javamelody-core-1.65.0","javamelody-core-1.64.0","javamelody-core-1.63.0","javamelody-core-1.62.0","javamelody-core-1.61.0","javamelody-core-1.60.0","javamelody-core-1.59.0","javamelody-core-1.58.0","javamelody-core-1.57.1","javamelody-core-1.57.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-15531.json","vanir_signatures_modified":"2026-07-08T17:15:40Z","vanir_signatures":[{"deprecated":false,"digest":{"length":701,"function_hash":"290680416238790860849901946091720060384"},"id":"CVE-2018-15531-1461a3f0","signature_type":"Function","signature_version":"v1","source":"https://github.com/javamelody/javamelody/commit/ef111822562d0b9365bd3e671a75b65bd0613353","target":{"file":"javamelody-core/src/main/java/net/bull/javamelody/PayloadNameRequestWrapper.java","function":"parseSoapMethodName"}},{"id":"CVE-2018-15531-daa3a8d6","signature_type":"Line","signature_version":"v1","source":"https://github.com/javamelody/javamelody/commit/ef111822562d0b9365bd3e671a75b65bd0613353","target":{"file":"javamelody-core/src/main/java/net/bull/javamelody/PayloadNameRequestWrapper.java"},"deprecated":false,"digest":{"line_hashes":["328692930432441516103607652630260348373","298394040672344309547826861720471087794","193106074442589336721762830267992845355","180543439916777456920344304702845623167"],"threshold":0.9}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}