Exposure of Sensitive Information to an Unauthorized Actor in Direct Web Remoting

2022-05-1703:46:06

Google

osv.dev

0.003 Low

EPSS

Percentile

71.1%

JSON

The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CPENameOperatorVersion
org.directwebremoting:dwreq2.0.3
org.directwebremoting:dwreq2.0.rc1
org.directwebremoting:dwreq2.0.1
org.directwebremoting:dwreq3.0.M1
org.directwebremoting:dwreq2.0.8
org.directwebremoting:dwreq2.0.9
org.directwebremoting:dwreq2.0.2
org.directwebremoting:dwreq2.0.10
org.directwebremoting:dwreq2.0.rc2

Name	Operator	Version
org.directwebremoting:dwr	eq	2.0.3
org.directwebremoting:dwr	eq	2.0.rc1
org.directwebremoting:dwr	eq	2.0.1
org.directwebremoting:dwr	eq	3.0.M1
org.directwebremoting:dwr	eq	2.0.8
org.directwebremoting:dwr	eq	2.0.9
org.directwebremoting:dwr	eq	2.0.2
org.directwebremoting:dwr	eq	2.0.10
org.directwebremoting:dwr	eq	2.0.rc2