CVE-2016-15011: Vulnerability in be.e_contract.dssp:dssp-client - Improper Restriction of XML External Entity Reference
Summary
CVE-2016-15011: dssp vulnerable to Improper Restriction of XML External Entity Reference. Affects be.e_contract.dssp:dssp-client versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The be.e_contract.dssp:dssp-client package is a Maven ecosystem package used for e-Contract dssp up to version 1.3.1. It provides functionality for signing and verifying electronic contracts. This package is vulnerable to an issue in the checkSignResponse function of the SignResponseVerifier.java file, which can lead to an XML external entity reference manipulation. This vulnerability has been assigned the identifier VDB-217549.
Vulnerability Detail
The vulnerability in be.e_contract.dssp:dssp-client allows for improper restriction of XML external entity references. An attacker can exploit this vulnerability to manipulate XML entities, potentially leading to various security issues such as information disclosure, server-side request forgery, and remote code execution. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
How To Fix
Minimum fixed version
1.3.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The be.e_contract.dssp:dssp-client package up to version 1.3.1 is vulnerable to an improper restriction of XML external entity reference issue. Upgrading to version 1.3.2 is recommended to fix this vulnerability and mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for be.e_contract.dssp:dssp-client →
FAQ
This vulnerability can be exploited by an attacker to manipulate XML entities, potentially leading to information disclosure, server-side request forgery, and remote code execution.
No, upgrading to the patched version 1.3.2 is the recommended solution to fix this vulnerability.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
For more information about this vulnerability, you can contact info@devnack.com for further support on vulnerability remediation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
