CVE-2019-1010202

2019-07-2314:15:13

Google

osv.dev

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.4%

JSON

Jeesite 1.2.7 is affected by: XML External Entity (XXE). The impact is: sensitive information disclosure. The component is: convertToModel() function in src/main/java/com.thinkgem.jeesite/modules/act/service/ActProcessService.java. The attack vector is: network connectivity,authenticated,must upload a specially crafted xml file. The fixed version is: 4.0 and later.

CPENameOperatorVersion
jeesiteeq1.0.3
jeesiteeq1.0.0
jeesiteeqV1.0.1
jeesiteeq1.0.4
jeesiteeq1.2.6
jeesiteeq1.2.7
jeesiteeq1.0.2
jeesiteeq1.0.5

Name	Operator	Version
jeesite	eq	1.0.3
jeesite	eq	1.0.0
jeesite	eq	V1.0.1
jeesite	eq	1.0.4
jeesite	eq	1.2.6
jeesite	eq	1.2.7
jeesite	eq	1.0.2
jeesite	eq	1.0.5

References

github.com/thinkgem/jeesite/blob/master/src/main/java/com/thinkgem/jeesite/modules/act/service/ActProcessService.java