What is GHSA-24wf-7vf2-pv59?

GHSA-24wf-7vf2-pv59 is a security advisory published by GitHub Security Advisories with High severity. XXE vulnerability on Launch import with externally-defined DTD file

Which CVE IDs does GHSA-24wf-7vf2-pv59 cover?

GHSA-24wf-7vf2-pv59 covers the following CVE IDs: CVE-2021-29620. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-24wf-7vf2-pv59?

GHSA-24wf-7vf2-pv59 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-24wf-7vf2-pv59?

GHSA-24wf-7vf2-pv59 affects 1 product, including: maven/com.epam.reportportal:service-api:\u003e= 3.1.0, \u003c 5.4.0.

GHSA-24wf-7vf2-pv59HighCVSS 7.5

XXE vulnerability on Launch import with externally-defined DTD file

Vendor

GitHub Security Advisories

Published

June 28, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-29620 →

📋 Description

Impact

Starting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery.

Patches

Fixed with: https://github.com/reportportal/service-api/pull/1392

Binaries

docker pull reportportal/service-api:5.4.0 https://github.com/reportportal/service-api/packages/846871?version=5.4.0

For more information

If you have any questions or comments about this advisory email us: [email protected]

🎯 Affected products1

maven/com.epam.reportportal:service-api:>= 3.1.0, < 5.4.0