GHSA-7qfm-6m33-rgg9

Suggest an improvement
Source
https://github.com/advisories/GHSA-7qfm-6m33-rgg9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-7qfm-6m33-rgg9/GHSA-7qfm-6m33-rgg9.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-7qfm-6m33-rgg9
Published
2021-08-13T15:21:59Z
Modified
2024-12-02T05:44:37.459084Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
XML External Entity Reference
Details

An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.

Database specific
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-611"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-06-28T19:08:40Z"
}
References

Affected packages

Maven / com.epam.reportportal:service-api

Package

Name
com.epam.reportportal:service-api
View open source insights on deps.dev
Purl
pkg:maven/com.epam.reportportal/service-api

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.12

Affected versions

2.*

2.6.0
2.7.2

3.*

3.0.1
3.1.1
3.2.0
3.2.1
3.3.2

4.*

4.0.0
4.1.1
4.2.1
4.3.10
4.3.11

Maven / com.epam.reportportal:service-api

Package

Name
com.epam.reportportal:service-api
View open source insights on deps.dev
Purl
pkg:maven/com.epam.reportportal/service-api

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Fixed
5.1.1

Affected versions

5.*

5.0.0
5.1.0