CVEvulnerability
CVE-2019-9843
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-06-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.1 MEDIUM — AV:N/AC:H/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-611
Description
In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.
Affected configurations
• diffplug gradle (< 3.20.0)
• diffplug maven (< 1.20.0)
Related
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- https://github.com/diffplug/spotless/blob/master/plugin-gradle/CHANGES.md#version-3200---march-11th-2018-javadoc-jcenter Release Notes, Third Party Advisory
- https://github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.md#version-1200---march-14th-2018-javadoc-jcenter Release Notes, Third Party Advisory
- https://github.com/diffplug/spotless/issues/358 Issue Tracking, Third Party Advisory
- https://github.com/diffplug/spotless/pull/369 Issue Tracking, Third Party Advisory
- https://lists.apache.org/thread.html/r7406e297228c42deeecdd12a576e39d63073faebf14b027b7608fdfd%40%3Cissues.iceberg.apache.org%3E lists.apache.org
- https://github.com/diffplug/spotless/blob/master/plugin-gradle/CHANGES.md#version-3200---march-11th-2018-javadoc-jcenter Release Notes, Third Party Advisory
- https://github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.md#version-1200---march-14th-2018-javadoc-jcenter Release Notes, Third Party Advisory
- https://github.com/diffplug/spotless/issues/358 Issue Tracking, Third Party Advisory
- https://github.com/diffplug/spotless/pull/369 Issue Tracking, Third Party Advisory
- https://lists.apache.org/thread.html/r7406e297228c42deeecdd12a576e39d63073faebf14b027b7608fdfd%40%3Cissues.iceberg.apache.org%3E lists.apache.org