PT-2023-11810 · Bonitasoft · Bonita-Connector-Webservice

Published 2023-01-05 · Updated 2024-05-17 · CVE-2020-36640

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions bonitasoft bonita-connector-webservice versions up to 1.3.0

Description A problematic issue was found in the software, affecting the TransformerConfigurationException function of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external entity reference.

Recommendations For bonitasoft bonita-connector-webservice versions up to 1.3.0, upgrade to version 1.3.1 to address this issue. As a temporary workaround, consider disabling the TransformerConfigurationException function until the patch is applied. Restrict access to the affected component to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-36640

GHSA-WG99-5VRX-J2GG

Affected Products

Bonita-Connector-Webservice

References · 9

• https://github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5 · Patch
• https://github.com/bonitasoft/bonita-connector-webservice/releases/tag/1.3.1 · Patch
• https://github.com/bonitasoft/bonita-connector-webservice/pull/17 · Patch
• https://osv.dev/vulnerability/GHSA-wg99-5vrx-j2gg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36640 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36640 · Vendor Advisory
• https://github.com/bonitasoft/bonita-connector-webservice · Note
• https://vuldb.com/?ctiid.217443 · Note
• https://vuldb.com/?id.217443 · Note