GitHub Advisoryadvisory · Maven

GHSA-h755-h99p-9ffv XML External Entity Reference in weixin-java-tools

CRITICAL Published 2022-05-14 Modified 2024-01-08 Official page ↗
Aliases
CVE-2019-5312
Ecosystem
Maven
Packages
com.github.binarywang:weixin-java-common
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2024-01-08

Affected packages

• Maven com.github.binarywang:weixin-java-common: < 3.3.2.B → fixed in 3.3.2.B

Description

An issue was discovered in weixin-java-tools. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file. NOTE: this issue exists because of an incomplete fix for CVE-2018-20318.

Related

Alias · CVE (1)

  • CVE-2019-5312 An issue was discovered in weixin-java-tools v3.3.0. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References