CVE-2020-12642: XXE vulnerability in Launch import in com.epam.reportportal:service-api
Summary
CVE-2020-12642: XXE vulnerability in Launch import. Affects com.epam.reportportal:service-api across 2 version ranges.
>= 3.1.0, < 4.3.12
>= 5.0.0, < 5.1.1
Fixed in 4.3.12 or 5.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.epam.reportportal:service-api package is an open-source project that provides a service for importing JUnit XML launch files. It allows users to import XML files containing test results and other related data. The package is widely used in various applications and systems that require test reporting and analysis functionality.
Vulnerability Detail
The package is vulnerable to an XML External Entity (XXE) attack. Starting from version 3.1.0, the XML parser used in the package does not properly prevent XXE attacks. This allows an attacker to craft a malicious XML file that can extract sensitive information from the Report Portal service-api module or perform server-side request forgery. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.1.0, < 4.3.124.3.12 -
>= 5.0.0, < 5.1.15.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The com.epam.reportportal:service-api package is vulnerable to an XXE vulnerability that allows for information extraction and server-side request forgery. Users are advised to update to the fixed versions (4.3.12 or 5.1.1) to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for com.epam.reportportal:service-api →
FAQ
The vulnerability allows an attacker to extract sensitive information from the Report Portal service-api module or perform server-side request forgery.
Every version of the package starting from 3.1.0 is affected.
Yes, the vulnerability has been fixed in versions 4.3.12 and 5.1.1 of the com.epam.reportportal:service-api package.
You can update to the fixed version by downloading it from the provided binary or Docker container download links.
The vulnerability was reported to the Report Portal Team by an external security researcher named Julien M.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.epam.reportportal:service-api.
