Lucene search

GitHub Advisory DatabaseGHSA-7V35-QWWJ-P98G

HistoryJul 05, 2019 - 9:07 p.m.

Improper Restriction of XML External Entity Reference in DiffPlug Spotless

2019-07-0521:07:40

CWE-611

GitHub Advisory Database

github.com

CVSS2

5.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

65.2%

JSON

In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn’t respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.

Affected configurations

Vulners

Node

com.diffplug.spotlessspotless-maven-pluginRange<1.20.0

com.diffplug.spotlessspotless-plugin-gradleRange<3.20.0

VendorProductVersionCPE
com.diffplug.spotlessspotless-maven-plugin*cpe:2.3:a:com.diffplug.spotless:spotless-maven-plugin:*:*:*:*:*:*:*:*
com.diffplug.spotlessspotless-plugin-gradle*cpe:2.3:a:com.diffplug.spotless:spotless-plugin-gradle:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
com.diffplug.spotless	spotless-maven-plugin	*	cpe:2.3:a:com.diffplug.spotless:spotless-maven-plugin::::::::
com.diffplug.spotless	spotless-plugin-gradle	*	cpe:2.3:a:com.diffplug.spotless:spotless-plugin-gradle::::::::

References

github.com/advisories/GHSA-7v35-qwwj-p98g

github.com/diffplug/spotless/blob/master/plugin-gradle/CHANGES.md#version-3200---march-11th-2018-javadoc-jcenter

github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.md#version-1200---march-14th-2018-javadoc-jcenter

github.com/diffplug/spotless/issues/358

github.com/diffplug/spotless/pull/369

nvd.nist.gov/vuln/detail/CVE-2019-9843

CVSS2

5.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

65.2%

JSON

Related for GHSA-7V35-QWWJ-P98G