GitHub Advisoryadvisory · Maven

GHSA-77cc-w3wm-6whp dssp vulnerable to Improper Restriction of XML External Entity Reference

CRITICAL Published 2023-01-06 Modified 2023-01-12 Official page ↗
Aliases
CVE-2016-15011
Ecosystem
Maven
Packages
be.e_contract.dssp:dssp-client
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2023-01-12

Affected packages

• Maven be.e_contract.dssp:dssp-client: < 1.3.2 → fixed in 1.3.2

Description

A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function `checkSignResponse` of the file `dssp-client/src/main/java/be/e_contract/dssp/client/SignResponseVerifier.java`. The manipulation leads to xml external entity reference. Upgrading to version 1.3.2 can address this issue. The name of the patch is ec4238349691ec66dd30b416ec6eaab02d722302. It is recommended to upgrade the affected component. The identifier VDB-217549 was assigned to this vulnerability.

Related

Alias · CVE (1)

  • CVE-2016-15011 A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References