PT-2023-31312 · Apache · Apache Cocoon

Cédric Damioli · Publicado 2023-11-30 · Atualizado 2023-12-07 · CVE-2023-49733

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Cocoon versions 2.2.0 through 2.2.x before 2.3.0 Apache Cocoon version 2.2.0

Description The issue is related to an Improper Restriction of XML External Entity Reference, which allows users to inject malicious code into XML documents. This can lead to Remote Code Execution (RCE). Users are advised to upgrade to a fixed version to resolve the issue.

Recommendations For Apache Cocoon versions 2.2.0 through 2.2.x before 2.3.0, upgrade to version 2.3.0, which fixes the issue. For Apache Cocoon version 2.2.0, upgrade to version 2.3.0, which fixes the issue.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2023-49733

GHSA-77JG-CPW9-73VG

Produtos afetados

Apache Cocoon

Referências · 10

• https://github.com/apache/cocoon · Nota
• https://twitter.com/oss_security/status/1730325992533557490 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-77jg-cpw9-73vg · Aviso do Fabricante
• https://t.me/cvenotify/61638 · Publicação no Telegram
• https://twitter.com/vulncure/status/1732817325261283513 · Publicação no Twitter
• http://openwall.com/lists/oss-security/2023/11/30/5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-49733 · Nota de Segurança
• https://lists.apache.org/thread/t87nntzt6dxw354zbqr9k7l7o1x8gq11 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1730205224793468976 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-49733 · Aviso do Fabricante