Lucene search
GoogleOSV:GHSA-C49V-35FF-Q9F7HistoryMay 24, 2022 - 5:29 p.m.
DotPlant2 Improper Restriction of XML External Entity Reference
2022-05-2417:29:01
Google
osv.dev
4
0.003 Low
EPSS
Percentile
69.2%
An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST[‘xml’]) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
| CPE | Name | Operator | Version |
|---|---|---|---|
| devgroup/dotplant | eq | 0.0.1 | |
| devgroup/dotplant | eq | 0.0.3 | |
| devgroup/dotplant | eq | 0.0.4 | |
| devgroup/dotplant | eq | 1.0.0 | |
| devgroup/dotplant | eq | 0.0.2 |
Related
cve
cve
CVE-2020-25750
2020-09-18 04:15:12
github
github
DotPlant2 Improper Restriction of XML External Entity Reference
2022-05-24 17:29:01
cvelist
cvelist
CVE-2020-25750
2020-09-18 03:25:50
nvd
nvd
CVE-2020-25750
2020-09-18 04:15:12
prion
prion
Code injection
2020-09-18 04:15:00