PT-2023-11810 · Bonitasoft · Bonita-Connector-Webservice

CVE-2020-36640 · Publicado 2023-01-05 · Atualizado 2024-05-17

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions bonitasoft bonita-connector-webservice versions up to 1.3.0

Description A problematic issue was found in the software, affecting the TransformerConfigurationException function of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external entity reference.

Recommendations For bonitasoft bonita-connector-webservice versions up to 1.3.0, upgrade to version 1.3.1 to address this issue. As a temporary workaround, consider disabling the TransformerConfigurationException function until the patch is applied. Restrict access to the affected component to minimize the risk of exploitation.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2020-36640

GHSA-WG99-5VRX-J2GG

Produtos afetados

Bonita-Connector-Webservice

Referências · 9

• https://github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5 · Correção
• https://github.com/bonitasoft/bonita-connector-webservice/releases/tag/1.3.1 · Correção
• https://github.com/bonitasoft/bonita-connector-webservice · Nota
• https://github.com/bonitasoft/bonita-connector-webservice/pull/17 · Correção
• https://osv.dev/vulnerability/GHSA-wg99-5vrx-j2gg · Aviso do Fabricante
• https://vuldb.com/?ctiid.217443 · Nota
• https://vuldb.com/?id.217443 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2020-36640 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2020-36640 · Aviso do Fabricante