GHSA-7qfm-6m33-rgg9

Source

https://github.com/advisories/GHSA-7qfm-6m33-rgg9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-7qfm-6m33-rgg9/GHSA-7qfm-6m33-rgg9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7qfm-6m33-rgg9

Published

2021-08-13T15:21:59Z

Modified

2024-12-02T05:36:23.012050Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

XML External Entity Reference

Details

An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-611"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-06-28T19:08:40Z"
}

References

Affected packages

Maven / com.epam.reportportal:service-api

Package

Name: com.epam.reportportal:service-api; View open source insights on deps.dev
Purl: pkg:maven/com.epam.reportportal/service-api

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.3.12

Affected versions

2.*

2.6.0

2.7.2

3.*

3.0.1

3.1.1

3.2.0

3.2.1

3.3.2

4.*

4.0.0

4.1.1

4.2.1

4.3.10

4.3.11

Maven / com.epam.reportportal:service-api

Package

Name: com.epam.reportportal:service-api; View open source insights on deps.dev
Purl: pkg:maven/com.epam.reportportal/service-api

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0

Fixed

5.1.1

Affected versions

5.*

5.0.0

5.1.0