Vulnerability · Published Jan 5, 2023 · Assigned by VulDB
CVE-2020-36641gturri aXMLRPC ResponseParser.java ResponseParser xml external entity reference
Medium 5.5
In plain English
A medium-severity XML external entity in aXMLRPC from gturri. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.14.0 is able to address this issue. The patch is identified as 456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | fr.turri:aXMLRPC | 1.12.1 | GHSA-g4r8-28fp-f255 |
| Ubuntu:22.04:LTS | axmlrpc | no fix listed | UBUNTU-CVE-2020-36641 |
| Ubuntu:24.04:LTS | axmlrpc | no fix listed | UBUNTU-CVE-2020-36641 |
| Ubuntu:25.10 | axmlrpc | no fix listed | UBUNTU-CVE-2020-36641 |
| Ubuntu:26.04:LTS | axmlrpc | no fix listed | UBUNTU-CVE-2020-36641 |
| Ubuntu:26.10 | axmlrpc | no fix listed | UBUNTU-CVE-2020-36641 |
Affected products (as reported)
Weakness: CWE-611 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- https://vuldb.com/?id.217450 vdb-entry, technical-description
- https://vuldb.com/?ctiid.217450 signature, permissions-required
- https://github.com/gturri/aXMLRPC/commit/456752ebc1ef4c0db980cb5b01a0b3cd0a9e0bae patch
- https://github.com/gturri/aXMLRPC/releases/tag/aXMLRPC-1.14.0 patch