CVE-2020-36641: aXMLRPC XML External Entity vulnerability in fr.turri:aXMLRPC
Summary
CVE-2020-36641: aXMLRPC XML External Entity vulnerability. Affects fr.turri:aXMLRPC versions < 1.12.1. Fixed in 1.12.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fr.turri:aXMLRPC is a Maven package that provides functionality for XML-RPC communication in Java applications. It allows developers to easily implement XML-RPC clients and servers. However, versions up to 1.12.0 are vulnerable to an XML External Entity (XXE) vulnerability in the ResponseParser function of the ResponseParser.java file. This vulnerability can be exploited to perform unauthorized access and disclosure of sensitive information.
Vulnerability Detail
The aXMLRPC package up to version 1.12.0 is affected by an XML External Entity (XXE) vulnerability. This vulnerability occurs when the application processes XML input containing a reference to an external entity. An attacker can exploit this vulnerability to read arbitrary files on the server or perform SSRF attacks, potentially leading to further compromise of the system. The vulnerability has been assigned the identifier CVE-2020-36641 and has a CVSS score of 9.8 (Critical).
How To Fix
Minimum fixed version
1.12.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version (1.12.1) to mitigate the risk.
Conclusion
The fr.turri:aXMLRPC package up to version 1.12.0 is vulnerable to an XML External Entity (XXE) vulnerability. To mitigate the risk, it is crucial to upgrade to version 1.12.1, which includes a patch for this vulnerability. It is recommended to use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for fr.turri:aXMLRPC →
FAQ
An XML External Entity (XXE) vulnerability occurs when an application processes XML input that includes a reference to an external entity. This can lead to unauthorized access and disclosure of sensitive information.
Exploiting this vulnerability can allow an attacker to read arbitrary files on the server or perform Server-Side Request Forgery (SSRF) attacks, potentially leading to further compromise of the system.
The CVSS score of this vulnerability is 9.8, which is considered Critical.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
For more information about this vulnerability, you can contact info@devnack.com. They can provide further support on vulnerability remediation.
