GitHub Advisoryadvisory · Maven

GHSA-7qfm-6m33-rgg9 XML External Entity Reference

HIGH Published 2021-08-13 Modified 2021-06-28 Official page ↗
Ecosystem
Maven
Packages
com.epam.reportportal:service-api
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2021-06-28

Affected packages

• Maven com.epam.reportportal:service-api: < 4.3.12 → fixed in 4.3.12 • Maven com.epam.reportportal:service-api: >= 5.0.0, < 5.1.1 → fixed in 5.1.1

Description

An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.

Related

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References