Lucene search

Veracode Vulnerability DatabaseVERACODE:7681

HistoryNov 02, 2018 - 10:05 a.m.

XML External Entity (XXE)

2018-11-0210:05:04

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:N/A:P

JSON

granite-client and granite-server is vulnerable to a XML external entity (XXE) attack. The library does not disable document type declarations, allowing a malicious user to pass an XML file to it conduct an XXE attack.

CPENameOperatorVersion
granite-serverle3.1.1.GA
granite-client-javale3.1.1.GA
graniteds java client core libeq3.0.0.M1- 3.0.0.M3
granite-server-corele3.1.1.GA
granite-generatoreq3.1.1.GA
granite-server-beanvalidationeq3.1.1.GA
granite-server-cdieq3.1.1.GA

Name	Operator	Version
granite-server	le	3.1.1.GA
granite-client-java	le	3.1.1.GA
graniteds java client core lib	eq	3.0.0.M1- 3.0.0.M3
granite-server-core	le	3.1.1.GA
granite-generator	eq	3.1.1.GA
granite-server-beanvalidation	eq	3.1.1.GA
granite-server-cdi	eq	3.1.1.GA

References

github.com/graniteds/graniteds/blob/3.1.0.GA/granite-common/src/main/java/org/granite/util/StdXMLUtil.java#L84

www.kb.cert.org/vuls/id/279472

www.securityfocus.com/bid/85426

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:N/A:P

JSON

Related for VERACODE:7681