XML External Entity (XXE)

2019-10-0805:49:31

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

62.2%

JSON

DiffPlug Spotless is vulnerable to XML external entities (XXE). The XML formatter has resolveExternalURI setting to true by default and it loads external DTD.

CPENameOperatorVersion
spotless-plugin-gradlele3.19.0
spotless-maven-pluginle1.19.0

CPE	Name	Operator	Version
	spotless-plugin-gradle	le	3.19.0
	spotless-maven-plugin	le	1.19.0

References

github.com/diffplug/spotless/blob/master/plugin-gradle/CHANGES.md#version-3200---march-11th-2018-javadoc-jcenter

github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.md#version-1200---march-14th-2018-javadoc-jcenter

github.com/diffplug/spotless/issues/358

github.com/diffplug/spotless/pull/369

0.002 Low

EPSS

Percentile

62.2%

JSON

Related for VERACODE:21653