What is GHSA-7qfm-6m33-rgg9?

GHSA-7qfm-6m33-rgg9 is a security advisory published by GitHub Security Advisories with High severity. XML External Entity Reference

Why does GHSA-7qfm-6m33-rgg9 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-7qfm-6m33-rgg9?

GHSA-7qfm-6m33-rgg9 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-7qfm-6m33-rgg9?

GHSA-7qfm-6m33-rgg9 affects 2 products, including: maven/com.epam.reportportal:service-api:\u003c 4.3.12; maven/com.epam.reportportal:service-api:\u003e= 5.0.0, \u003c 5.1.1.

GHSA-7qfm-6m33-rgg9HighCVSS 7.5Disclosed before NVD

XML External Entity Reference

Vendor

GitHub Security Advisories

Published

August 13, 2021

Last Modified

January 9, 2023

📋 Description

An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.

🎯 Affected products2

maven/com.epam.reportportal:service-api:< 4.3.12
maven/com.epam.reportportal:service-api:>= 5.0.0, < 5.1.1

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2020-12642
https://github.com/reportportal/reportportal/blob/master/SECURITY_ADVISORIES.md
https://github.com/advisories/GHSA-7qfm-6m33-rgg9