XML External Entity (XXE)

2020-02-1904:27:53

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.008 Low

EPSS

Percentile

81.1%

JSON

quartz is vulnerable to XML external entity (XXE) attacks. The external DTDs and doctype declarations are not disabled by default, allowing an attacker to access system files, or perform requests on behalf of the server via a malicious XML document. The vulnerability also allows an attacker to perform entity expansion attacks which could result in an application crash.

CPENameOperatorVersion
quartzle2.1.3
quartzle2.3.1
apache-commons-compresseq1.18__1.module_el8.0.0+30+832da3a1
python-werkzeugeq0.14.1__5.el8ost
m2cryptoeq0.35.2__5.epel8.playground
apache-commons-jxpatheq1.3__29.module_el8.0.0+30+832da3a1
python-ovsdbappeq0.17.0__0.20190923110620.74b52bb.el8ost
python-ovsdbappeq0.15.0__0.20190312195947.bc06517.el8ost
python-ovsdbappeq0.15.0__0.20191008180429.bc06517.el8ost
ansible-runnereq1.3.4__2.el8ar

Name	Operator	Version
quartz	le	2.1.3
quartz	le	2.3.1
apache-commons-compress	eq	1.18__1.module_el8.0.0+30+832da3a1
python-werkzeug	eq	0.14.1__5.el8ost
m2crypto	eq	0.35.2__5.epel8.playground
apache-commons-jxpath	eq	1.3__29.module_el8.0.0+30+832da3a1
python-ovsdbapp	eq	0.17.0__0.20190923110620.74b52bb.el8ost
python-ovsdbapp	eq	0.15.0__0.20190312195947.bc06517.el8ost
python-ovsdbapp	eq	0.15.0__0.20191008180429.bc06517.el8ost
ansible-runner	eq	1.3.4__2.el8ar