What is GHSA-c49v-35ff-q9f7?

GHSA-c49v-35ff-q9f7 is a security advisory published by GitHub Security Advisories with High severity. DotPlant2 Improper Restriction of XML External Entity Reference

Which CVE IDs does GHSA-c49v-35ff-q9f7 cover?

GHSA-c49v-35ff-q9f7 covers the following CVE IDs: CVE-2020-25750. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c49v-35ff-q9f7?

GHSA-c49v-35ff-q9f7 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-c49v-35ff-q9f7?

GHSA-c49v-35ff-q9f7 affects 1 product, including: composer/devgroup/dotplant:\u003c 2020-09-14.

GHSA-c49v-35ff-q9f7HighCVSS 7.5

DotPlant2 Improper Restriction of XML External Entity Reference

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

April 22, 2024

🔗 CVE IDs covered (1)

CVE-2020-25750 →

📋 Description

An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

🎯 Affected products1

composer/devgroup/dotplant:< 2020-09-14

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-25750
https://github.com/DevGroup-ru/dotplant2/issues/400
https://github.com/DevGroup-ru/dotplant2/commit/fee86c7052c227762c7325eb5c2811d9323f8429
https://github.com/advisories/GHSA-c49v-35ff-q9f7