PT-2020-5503 · Mpxj · Mpxj

Published 2020-08-29 · Updated 2022-09-02 · CVE-2020-25020

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MPXJ versions 8.1.3 and earlier

Description The issue is related to the incorrect restriction of XML external entity references in the GanttProjectReader and PhoenixReader components of the MPXJ library. This can allow a remote attacker to conduct XXE attacks.

Recommendations For MPXJ versions 8.1.3 and earlier, consider disabling the GanttProjectReader and PhoenixReader components until a patch is available to prevent XXE attacks. Restrict access to these components to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2021-00923

CVE-2020-25020

GHSA-WCP5-M52F-MHH5

Affected Products

Mpxj

References · 9

• https://github.com/joniles/mpxj/pull/178/commits/c3e457f7a16facfe563eade82b0fa8736a8c96f9 · Patch
• https://bdu.fstec.ru/vul/2021-00923 · Security Note
• https://oracle.com/security-alerts/cpujan2021.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-25020 · Security Note
• https://osv.dev/vulnerability/GHSA-wcp5-m52f-mhh5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25020 · Vendor Advisory
• https://github.com/joniles/mpxj · Note
• https://github.com/joniles/mpxj/releases/tag/v8.1.4 · Note
• https://cert-portal.siemens.com/productcert/html/ssa-137900.html · Note