PT-2022-11776 · Soa-Model · Soa-Model

Yuligesec · Published 2022-03-25 · Updated 2022-07-28 · CVE-2021-43090

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions soa-model versions prior to 1.6.4

Description An XML External Entity (XXE) vulnerability exists in the WSDLParser function. This issue affects the soa-model toolkit and Java API for WSDL, WADL, and XML Schema. The vulnerability has been fixed in version 1.6.4.

Recommendations For versions prior to 1.6.4, update to version 1.6.4 to resolve the issue. As a temporary workaround, consider disabling the WSDLParser function until a patch is available.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-43090

GHSA-PV39-QP28-4MGH

Affected Products

Soa-Model

References · 11

• 🔥 https://github.com/membrane/soa-model/issues/281 · Exploit
• https://github.com/membrane/soa-model/commit/19de16902468e7963cc4dc6b544574bc1ea3f251 · Patch
• https://github.com/membrane/soa-model/commit/3aa295f155f621d5ea661cb9a0604013fc8fd8ff · Patch
• https://osv.dev/vulnerability/GHSA-pv39-qp28-4mgh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43090 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43090 · Vendor Advisory
• https://github.com/membrane/soa-model · Note
• https://github.com/membrane/soa-model/releases/tag/v1.6.4 · Note
• https://t.me/cvenotify/33938 · Telegram Post
• https://t.me/cibsecurity/39540 · Telegram Post
• https://t.me/cvenotify/28204 · Telegram Post