PT-2023-31312 · Apache · Apache Cocoon

Cédric Damioli · Published 2023-11-30 · Updated 2023-12-07 · CVE-2023-49733

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Cocoon versions 2.2.0 through 2.2.x before 2.3.0 Apache Cocoon version 2.2.0

Description The issue is related to an Improper Restriction of XML External Entity Reference, which allows users to inject malicious code into XML documents. This can lead to Remote Code Execution (RCE). Users are advised to upgrade to a fixed version to resolve the issue.

Recommendations For Apache Cocoon versions 2.2.0 through 2.2.x before 2.3.0, upgrade to version 2.3.0, which fixes the issue. For Apache Cocoon version 2.2.0, upgrade to version 2.3.0, which fixes the issue.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-49733

GHSA-77JG-CPW9-73VG

Affected Products

Apache Cocoon

References · 10

• https://osv.dev/vulnerability/GHSA-77jg-cpw9-73vg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49733 · Security Note
• https://lists.apache.org/thread/t87nntzt6dxw354zbqr9k7l7o1x8gq11 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49733 · Vendor Advisory
• https://github.com/apache/cocoon · Note
• https://twitter.com/oss_security/status/1730325992533557490 · Twitter Post
• https://t.me/cvenotify/61638 · Telegram Post
• https://twitter.com/vulncure/status/1732817325261283513 · Twitter Post
• http://openwall.com/lists/oss-security/2023/11/30/5 · Note
• https://twitter.com/VulmonFeeds/status/1730205224793468976 · Twitter Post