CVE-2017-16521

In Inedo BuildMaster before 5.8.2, XslTransform was used where XslCompiledTransform should have been used.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 72%
VendorProductVersion
inedobuildmaster
𝑥
< 5.8.2
𝑥
= Vulnerable software versions
References
https://gitlab.com/inedo/buildmaster/commit/4f4c737fefe44c3227535946f535fb7ef468d721
https://inedo.com/blog/buildmaster-582-released
https://inedo.com/buildmaster/versions#v5.8
https://inedo.myjetbrains.com/youtrack/issue/BM-3108
https://inedo.myjetbrains.com/youtrack/issue/EDO-3334
https://gitlab.com/inedo/buildmaster/commit/4f4c737fefe44c3227535946f535fb7ef468d721
https://inedo.com/blog/buildmaster-582-released
https://inedo.com/buildmaster/versions#v5.8
https://inedo.myjetbrains.com/youtrack/issue/BM-3108
https://inedo.myjetbrains.com/youtrack/issue/EDO-3334