CVE-2020-36641

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-36641
A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.14.0 is able to address this issue. The patch is identified as 456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.9 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:A/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 4.4 / Impact : 6.4

Access Vector ADJACENT_NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/gturri/aXMLRPC/commit/456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae
https://github.com/gturri/aXMLRPC/releases/tag/aXMLRPC-1.14.0
https://vuldb.com/?ctiid.217450 Permissions Required Third Party Advisory
https://vuldb.com/?id.217450 Permissions Required Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gturri:axmlrpc:*:*:*:*:*:*:*:*
History

11 Apr 2024, 01:08

Type Values Removed Values Added
Summary
  • (es) Se ha encontrado una vulnerabilidad en gturri aXMLRPC hasta 1.12.0 y se ha clasificado como problemática. Esta vulnerabilidad afecta a la función ResponseParser del archivo src/main/java/de/timroes/axmlrpc/ResponseParser.java. La manipulación conduce a una referencia de entidad externa xml. La actualización a la versión 1.12.1 puede solucionar este problema. El parche se identifica como ad6615b3ec41353e614f6ea5fdd5b046442a832b. Se recomienda actualizar el componente afectado. VDB-217450 es el identificador asignado a esta vulnerabilidad.

13 Feb 2024, 21:15

Type Values Removed Values Added
References
  • {'url': 'https://github.com/gturri/aXMLRPC/commit/ad6615b3ec41353e614f6ea5fdd5b046442a832b', 'tags': ['Patch'], 'source': 'cna@vuldb.com'}
  • {'url': 'https://github.com/gturri/aXMLRPC/releases/tag/aXMLRPC-1.12.1', 'tags': ['Release Notes'], 'source': 'cna@vuldb.com'}
  • () https://github.com/gturri/aXMLRPC/commit/456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae -
  • () https://github.com/gturri/aXMLRPC/releases/tag/aXMLRPC-1.14.0 -
Summary (en) A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.12.1 is able to address this issue. The patch is identified as ad6615b3ec41353e614f6ea5fdd5b046442a832b. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability. (en) A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.14.0 is able to address this issue. The patch is identified as 456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.

24 Jan 2024, 18:21

Type Values Removed Values Added
New CVE
Information

Published : 2023-01-05 12:15

Updated : 2024-04-11 01:08

NVD link : CVE-2020-36641

Mitre link : CVE-2020-36641

CVE.ORG link : CVE-2020-36641

JSON object : View

Products Affected

gturri

  • axmlrpc
CWE
CWE-611

Improper Restriction of XML External Entity Reference