CVEvulnerability
CVE-2020-6958
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-01-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:P
- Weaknesses
- CWE-611
Description
An XXE vulnerability in JnlpSupport in Yet Another Java Service Wrapper (YAJSW) 12.14, as used in NSA Ghidra and other products, allows attackers to exfiltrate data from remote hosts and potentially cause denial-of-service.
Affected configurations
• yet another java service wrapper project yet another java service wrapper 12.14
Related
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- https://github.com/NationalSecurityAgency/ghidra/issues/943 Exploit, Third Party Advisory
- https://github.com/purpleracc00n/Exploits-and-PoC/blob/master/XXE%20in%20YAJSW%E2%80%99s%20JnlpSupport%20affects%20Ghidra%20Server.md Third Party Advisory
- https://sourceforge.net/p/yajsw/bugs/166/ Exploit, Third Party Advisory
- https://github.com/NationalSecurityAgency/ghidra/issues/943 Exploit, Third Party Advisory
- https://github.com/purpleracc00n/Exploits-and-PoC/blob/master/XXE%20in%20YAJSW%E2%80%99s%20JnlpSupport%20affects%20Ghidra%20Server.md Third Party Advisory
- https://sourceforge.net/p/yajsw/bugs/166/ Exploit, Third Party Advisory