GHSA-mgh8-hcwj-h57v

Source

https://github.com/advisories/GHSA-mgh8-hcwj-h57v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-mgh8-hcwj-h57v/GHSA-mgh8-hcwj-h57v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mgh8-hcwj-h57v

Aliases

CVE-2019-17554

Published

2020-02-04T22:37:43Z

Modified

2023-11-08T04:01:24Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Improper Restriction of XML External Entity Reference in Apache Olingo

Details

The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks.

Database specific

{
    "cwe_ids":  [
        "CWE-611"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-02-04T22:29:36Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

Maven / org.apache.olingo:odata-client-core

Package

Name: org.apache.olingo:odata-client-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.olingo/odata-client-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0

Fixed

4.7.0

Affected versions

4.*

4.0.0

4.1.0

4.2.0

4.3.0-beta

4.3.0

4.4.0

4.5.0

4.6.0

Database specific

last_known_affected_version_range

"<= 4.6.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-mgh8-hcwj-h57v/GHSA-mgh8-hcwj-h57v.json"

Maven / org.apache.olingo:odata-server-core