GitHub Advisoryadvisory · Maven

GHSA-wg99-5vrx-j2gg bonita-connector-webservice XML External Entity vulnerability

CRITICAL Published 2023-01-05 Modified 2023-01-11 Official page ↗
Aliases
CVE-2020-36640
Ecosystem
Maven
Packages
org.bonitasoft.connectors:bonita-connector-webservice
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2023-01-09

Affected packages

• Maven org.bonitasoft.connectors:bonita-connector-webservice: < 1.3.1 → fixed in 1.3.1

Description

A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function `TransformerConfigurationException` of the file `src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java`. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 can address this issue. The name of the patch is a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443.

Related

Alias · CVE (1)

  • CVE-2020-36640 A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References