CVE-2020-36640: bonita-connector-webservice XML External Entity vulnerability
Summary
CVE-2020-36640: bonita-connector-webservice XML External Entity vulnerability. Affects org.bonitasoft.connectors:bonita-connector-webservice versions < 1.3.1. Fixed in 1.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bonita-connector-webservice is a Maven package that provides functionality for connecting to web services in the Bonita platform. It allows users to integrate external web services into their Bonita applications. The package is vulnerable to an XML External Entity (XXE) attack, which can lead to the disclosure of sensitive information or denial of service.
Vulnerability Detail
The bonita-connector-webservice package up to version 1.3.0 is affected by a vulnerability that allows for XML External Entity (XXE) attacks. This vulnerability is present in the TransformerConfigurationException function of the SecureWSConnector.java file. An attacker can exploit this vulnerability to reference external entities in XML documents, potentially leading to the disclosure of sensitive information or denial of service. The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is CVE-2020-36640. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
1.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version as soon as possible.
Conclusion
The bonita-connector-webservice package up to version 1.3.0 is vulnerable to an XML External Entity (XXE) attack. To mitigate this vulnerability, it is crucial to upgrade to version 1.3.1 and apply the provided patch. Failure to do so may result in the disclosure of sensitive information or denial of service. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.bonitasoft.connectors:bonita-connector-webservice →
FAQ
The vulnerability allows an attacker to perform XML External Entity (XXE) attacks, which can lead to the disclosure of sensitive information or denial of service.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your pom.xml file to the playground, and it will alert you if the bonita-connector-webservice package is vulnerable.
Yes, upgrading the bonita-connector-webservice package to version 1.3.1 will fix this vulnerability. Make sure to apply the provided patch (a12ad691c05af19e9061d7949b6b828ce48815d5) during the upgrade process.
There are no known public exploits for this vulnerability at the moment. However, it is important to upgrade to the fixed version to prevent potential exploitation.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-wg99-5vrx-j2gg/GHSA-wg99-5vrx-j2gg.json).
