Lucene search

GitHub Advisory DatabaseGHSA-GQGV-2GP3-QQP3

HistoryMay 14, 2022 - 3:00 a.m.

WeChat Pay Java SDK allows XXE

2022-05-1403:00:29

CWE-611

GitHub Advisory Database

github.com

wechat pay

java sdk

xxe vulnerability

wxpayutil

merchant notification url

software

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.006

Percentile

78.6%

JSON

WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a merchant notification URL.

Affected configurations

Vulners

Node

com.github.wxpaywxpay-sdkRange≤3

VendorProductVersionCPE
com.github.wxpaywxpay-sdk*cpe:2.3:a:com.github.wxpay:wxpay-sdk:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
com.github.wxpay	wxpay-sdk	*	cpe:2.3:a:com.github.wxpay:wxpay-sdk::::::::

References

github.com/advisories/GHSA-gqgv-2gp3-qqp3

nvd.nist.gov/vuln/detail/CVE-2018-13439

packetstormsecurity.com/files/148390/WeChat-Pay-SDK-XXE-Injection.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.006

Percentile

78.6%

JSON

Related for GHSA-GQGV-2GP3-QQP3