Vulnerability · Published Jan 5, 2023 · Assigned by VulDB
CVE-2020-36640bonitasoft bonita-connector-webservice SecureWSConnector.java TransformerConfigurationException xml external entity reference
Medium 5.5
In plain English
A medium-severity XML external entity in bonita-connector-webservice from bonitasoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 is able to address this issue. The patch is named a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.bonitasoft.connectors:bonita-connector-webservice | 1.3.1 | GHSA-wg99-5vrx-j2gg |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| bonitasoft | bonita-connector-webservice | 1.01.11.21.3 |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- https://vuldb.com/?id.217443 vdb-entry, technical-description
- https://vuldb.com/?ctiid.217443 signature, permissions-required
- https://github.com/bonitasoft/bonita-connector-webservice/pull/17 issue-tracking
- https://github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5 patch
- https://github.com/bonitasoft/bonita-connector-webservice/releases/tag/1.3.1 patch