CVE-2018-20433: XML External Entity Reference in mchange:c3p0
Summary
CVE-2018-20433: XML External Entity Reference in mchange:c3p0. Affects com.mchange:c3p0 versions < 0.9.5.3. Fixed in 0.9.5.3. How to fix ↓
Also tracked for
- c3p0 · Debian:11
The same CVE-2018-20433 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mchange:c3p0 package is a connection pooling library for Java applications. It provides a set of APIs and configurations to manage database connections efficiently. This vulnerability affects versions 0.9.5.2 and below of the c3p0 library. The library is commonly used in Maven projects.
Vulnerability Detail
The vulnerability, identified as CVE-2018-20433, is an XML External Entity (XXE) reference issue. It occurs in the extractXmlConfigFromInputStream function within the C3P0ConfigXmlUtils.java file during the initialization process. This vulnerability allows an attacker to exploit XML parsing functionality and potentially read arbitrary files or execute remote code. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Latest published version: 0.14.2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.5.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the library to the fixed version as soon as possible.
Conclusion
The XML External Entity Reference vulnerability in the mchange:c3p0 library can lead to unauthorized access, data leakage, or system compromise. It is crucial to update the library to version 0.9.5.3 or above to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.mchange:c3p0 →
FAQ
This vulnerability allows an attacker to potentially read arbitrary files or execute remote code, leading to unauthorized access, data leakage, or system compromise.
If your application uses the c3p0 library version 0.9.5.2 or below, it is affected by this vulnerability. You can verify the vulnerability status of your application using the Vulert Playground at Vulert Scanner.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to update the library to the fixed version to mitigate the risk.
No, the recommended approach is to update the c3p0 library to the fixed version. Patching the vulnerability manually may not provide complete protection and could introduce other issues.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/advisories/GHSA-q485-j897-qc27.
Related vulnerabilities
Recent vulnerabilities recorded for com.mchange:c3p0.
