gturri aXMLRPC up to 1.12.0 ResponseParser.java ResponseParser xml external entity reference
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
6.9 | $0-$5k | 0.03 |
A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser
of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation with an unknown input leads to a xml external entity reference vulnerability. The CWE definition for the vulnerability is CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:
A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.14.0 is able to address this issue. The patch is identified as 456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.
The weakness was published 01/25/2024 as 456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae. The advisory is available at github.com. This vulnerability was named CVE-2020-36641. Technical details are known, but there is no available exploit.
Upgrading to version 1.14.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version. The advisory contains the following remark:
This commit fixes the issue described on https://cwe.mitre.org/data/definitions/611.html
Product
Vendor
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔒VulDB CVSS-BT Score: 🔒
VulDB Vector: 🔒
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.9VulDB Meta Temp Score: 6.9
VulDB Base Score: 5.5
VulDB Temp Score: 5.3
VulDB Vector: 🔒
VulDB Reliability: 🔍
NVD Base Score: 9.8
NVD Vector: 🔒
CNA Base Score: 5.5
CNA Vector (VulDB): 🔒
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
NVD Base Score: 🔒
Exploiting
Class: Xml external entity referenceCWE: CWE-611 / CWE-610
ATT&CK: Unknown
Local: No
Remote: Partially
Availability: 🔒
Status: Not defined
EPSS Score: 🔒
EPSS Percentile: 🔒
Price Prediction: 🔍
Current Price Estimation: 🔒
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔒
Upgrade: aXMLRPC 1.14.0
Patch: 456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae
Timeline
01/05/2023 CVE reserved01/05/2023 VulDB entry created
01/25/2024 Advisory disclosed
02/13/2024 VulDB entry last update
Sources
Advisory: 456752ebc1ef4c0db980cb5b01a0b3cd0a9e0baeStatus: Confirmed
CVE: CVE-2020-36641 (🔒)
Entry
Created: 01/05/2023 12:34Updated: 02/13/2024 22:02
Changes: 01/05/2023 12:34 (45), 01/28/2023 15:53 (2), 01/28/2023 15:59 (28), 02/13/2024 21:57 (7), 02/13/2024 22:02 (1)
Complete: 🔍
Committer: gturri
No comments yet. Languages: en.
Please log in to comment.