Vulnerability · Published Sep 11, 2020 · Assigned by apache
CVE-2020-11991
High 7.5
In plain English
A high-severity security flaw in Apache Cocoon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 72.5% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)72.5%top 0.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache Cocoon | Apache Cocoon 2.1.0 to 2.1.12 |