CVE-2019-9843

2019-06-2818:15:15

Google

osv.dev

6.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

62.2%

JSON

In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn’t respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.

CPENameOperatorVersion
spotlesseqlib/1.13.0
spotlesseqext-eclipse-cdt/9.4.5
spotlesseqgradle/3.0.0.BETA
spotlesseqgradle/3.18.0
spotlesseqlib/1.0.0.BETA3
spotlesseqmaven/1.15.0
spotlesseqext-eclipse-base/3.1.0
spotlesseq1.0
spotlesseqlib/1.0.0
spotlesseqmaven/1.19.0

Name	Operator	Version
spotless	eq	lib/1.13.0
spotless	eq	ext-eclipse-cdt/9.4.5
spotless	eq	gradle/3.0.0.BETA
spotless	eq	gradle/3.18.0
spotless	eq	lib/1.0.0.BETA3
spotless	eq	maven/1.15.0
spotless	eq	ext-eclipse-base/3.1.0
spotless	eq	1.0
spotless	eq	lib/1.0.0
spotless	eq	maven/1.19.0