PT-2023-11811 · Gturri · Xmlrpc

Gturri · Publicado 2023-01-05 · Atualizado 2024-05-17 · CVE-2020-36641

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions gturri aXMLRPC versions up to 1.12.0

Description A vulnerability was found in the ResponseParser function of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference.

Recommendations For gturri aXMLRPC versions up to 1.12.0, upgrade to version 1.12.1 or higher to address this issue. As a temporary workaround, consider disabling the ResponseParser function until a patch is available. Restrict access to the vulnerable component to minimize the risk of exploitation.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2020-36641

GHSA-G4R8-28FP-F255

Produtos afetados

Xmlrpc

Referências · 21

• https://github.com/gturri/aXMLRPC · Nota
• https://github.com/gturri/aXMLRPC/releases/tag/aXMLRPC-1.14.0 · Correção
• https://github.com/gturri/aXMLRPC/commit/456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae · Correção
• https://github.com/gturri/aXMLRPC/releases/tag/aXMLRPC-1.12.1 · Nota
• https://github.com/gturri/aXMLRPC/commit/ad6615b3ec41353e614f6ea5fdd5b046442a832b · Nota
• https://cve.org/CVERecord?id=CVE-2020-36641 · Nota de Segurança
• https://twitter.com/DynatracerChris/status/1751194704551825605 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2020-36641 · Nota de Segurança
• https://t.me/cvenotify/41294 · Publicação no Telegram
• https://t.me/cvenotify/68567 · Publicação no Telegram
• https://twitter.com/Dynatrace/status/1750949478251520461 · Publicação no Twitter
• https://vuldb.com/?id.217450 · Nota
• https://osv.dev/vulnerability/GHSA-g4r8-28fp-f255 · Aviso do Fabricante
• https://t.me/cvenotify/71331 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36641 · Aviso do Fabricante