XML External Entity (XXE)

2020-02-1904:27:53

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

quartz is vulnerable to XML external entity (XXE) attacks. The external DTDs and doctype declarations are not disabled by default, allowing an attacker to access system files, or perform requests on behalf of the server via a malicious XML document. The vulnerability also allows an attacker to perform entity expansion attacks which could result in an application crash.

CPENameOperatorVersion
quartzle2.1.3
quartzle2.3.1
apache-commons-compresseq1.18__1.module_el8.0.0+30+832da3a1
python-werkzeugeq0.14.1__5.el8ost
m2cryptoeq0.35.2__5.epel8.playground
apache-commons-jxpatheq1.3__29.module_el8.0.0+30+832da3a1
python-ovsdbappeq0.17.0__0.20190923110620.74b52bb.el8ost
python-ovsdbappeq0.15.0__0.20190312195947.bc06517.el8ost
python-ovsdbappeq0.15.0__0.20191008180429.bc06517.el8ost
ansible-runnereq1.3.4__2.el8ar

Name	Operator	Version
quartz	le	2.1.3
quartz	le	2.3.1
apache-commons-compress	eq	1.18__1.module_el8.0.0+30+832da3a1
python-werkzeug	eq	0.14.1__5.el8ost
m2crypto	eq	0.35.2__5.epel8.playground
apache-commons-jxpath	eq	1.3__29.module_el8.0.0+30+832da3a1
python-ovsdbapp	eq	0.17.0__0.20190923110620.74b52bb.el8ost
python-ovsdbapp	eq	0.15.0__0.20190312195947.bc06517.el8ost
python-ovsdbapp	eq	0.15.0__0.20191008180429.bc06517.el8ost
ansible-runner	eq	1.3.4__2.el8ar