Vulnerability · Published Jun 23, 2021 · Assigned by GitHub_M
CVE-2021-29620XXE vulnerability on Launch import with externally-defined DTD file
High 7.5
In plain English
A high-severity XML external entity in reportportal from reportportal. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. This will be resolved in the 5.4.0 release.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.epam.reportportal:service-api | 5.4.0 | GHSA-24wf-7vf2-pv59 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| reportportal | reportportal | >= 3.1.0, < 5.4.0 |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/reportportal/reportportal/security/advisories/GHSA-24wf-7vf2-pv59 x_refsource_CONFIRM
- https://github.com/reportportal/service-api/pull/1392 x_refsource_MISC
- https://mvnrepository.com/artifact/com.epam.reportportal/service-api x_refsource_MISC