GitHub Advisoryadvisory · Maven

GHSA-7v35-qwwj-p98g Improper Restriction of XML External Entity Reference in DiffPlug Spotless

HIGH Published 2019-07-05 Modified 2022-11-17 Official page ↗
Aliases
CVE-2019-9843
Ecosystem
Maven
Packages
com.diffplug.spotless:spotless-plugin-gradle, com.diffplug.spotless:spotless-maven-plugin
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2019-07-01

Affected packages

• Maven com.diffplug.spotless:spotless-plugin-gradle: < 3.20.0 → fixed in 3.20.0 • Maven com.diffplug.spotless:spotless-maven-plugin: < 1.20.0 → fixed in 1.20.0

Description

In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.

Related

Alias · CVE (1)

  • CVE-2019-9843 In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References