XML External Entity Reference

2021-08-1315:21:59

Google

osv.dev

0.002 Low

EPSS

Percentile

53.9%

JSON

An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.

CPENameOperatorVersion
com.epam.reportportal:service-apieq5.1.0
com.epam.reportportal:service-apieq4.2.1
com.epam.reportportal:service-apieq3.1.1
com.epam.reportportal:service-apieq4.1.1
com.epam.reportportal:service-apieq4.3.11
com.epam.reportportal:service-apieq4.3.10
com.epam.reportportal:service-apieq5.0.0
com.epam.reportportal:service-apieq3.2.0
com.epam.reportportal:service-apieq3.3.2
com.epam.reportportal:service-apieq2.7.2

Name	Operator	Version
com.epam.reportportal:service-api	eq	5.1.0
com.epam.reportportal:service-api	eq	4.2.1
com.epam.reportportal:service-api	eq	3.1.1
com.epam.reportportal:service-api	eq	4.1.1
com.epam.reportportal:service-api	eq	4.3.11
com.epam.reportportal:service-api	eq	4.3.10
com.epam.reportportal:service-api	eq	5.0.0
com.epam.reportportal:service-api	eq	3.2.0
com.epam.reportportal:service-api	eq	3.3.2
com.epam.reportportal:service-api	eq	2.7.2