PT-2023-11811 · Gturri · Xmlrpc

Gturri · Published 2023-01-05 · Updated 2024-05-17 · CVE-2020-36641

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions gturri aXMLRPC versions up to 1.12.0

Description A vulnerability was found in the ResponseParser function of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference.

Recommendations For gturri aXMLRPC versions up to 1.12.0, upgrade to version 1.12.1 or higher to address this issue. As a temporary workaround, consider disabling the ResponseParser function until a patch is available. Restrict access to the vulnerable component to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-36641

GHSA-G4R8-28FP-F255

Affected Products

Xmlrpc

References · 21

• https://github.com/gturri/aXMLRPC/releases/tag/aXMLRPC-1.14.0 · Patch
• https://github.com/gturri/aXMLRPC/commit/456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae · Patch
• https://cve.org/CVERecord?id=CVE-2020-36641 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36641 · Security Note
• https://osv.dev/vulnerability/GHSA-g4r8-28fp-f255 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36641 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36641 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36641 · Vendor Advisory
• https://github.com/gturri/aXMLRPC · Note
• https://github.com/gturri/aXMLRPC/releases/tag/aXMLRPC-1.12.1 · Note
• https://github.com/gturri/aXMLRPC/commit/ad6615b3ec41353e614f6ea5fdd5b046442a832b · Note
• https://twitter.com/DynatracerChris/status/1751194704551825605 · Twitter Post
• https://t.me/cvenotify/41294 · Telegram Post
• https://t.me/cvenotify/68567 · Telegram Post
• https://twitter.com/Dynatrace/status/1750949478251520461 · Twitter Post