Security readout for executives and security teams
Plain-English summary
This issue lets a logged-in remote user abuse XML handling in Kofax Front Office Server Administration Console 4.1.1.11.0.5212 to read files from the server. The sources do not provide a CVSS score, patch status, or evidence of active exploitation.
Executive priority
Treat this as a targeted exposure review item, not a confirmed emergency. Prioritize if the Kofax administration console is accessible beyond a small trusted administrator group.
Technical view
The CVE describes an XXE vulnerability in the package import path, specifically XML inside an imported package configuration ZIP submitted through the PackageService upload file parameter. Impact is arbitrary file read by a remote authenticated user. Source details are limited.
Likely exposure
Exposure is likely limited to environments running Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 where authenticated users can access package import functionality. Internet exposure is not stated in the provided sources.
Exploitation context
The attack requires authentication according to the CVE description. CISA KEV status is false in the bundle, and the provided sources do not establish active exploitation in the wild.
Researcher notes
Evidence supports remote authenticated arbitrary file read through XXE in one named Kofax Front Office Server Administration Console version. The bundle lacks CVSS, CWE mapping, vendor fix details, and exploitation evidence.
Mitigation direction
- Check Kofax or current vendor guidance for fixed versions or supported upgrades.
- Restrict Administration Console access to trusted networks and administrators.
- Limit package import permissions to users with a clear operational need.
- Monitor for unexpected package import activity and file access anomalies.
Validation and detection
- Inventory Kofax Front Office Server Administration Console versions in use.
- Confirm whether version 4.1.1.11.0.5212 is present.
- Review which authenticated users can import package configuration ZIP files.
- Check logs for unusual package upload or import events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-17289 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17289-XXE-KofaxCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.