A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 is able to address this issue. The patch is named a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443.
References
| Link | Resource |
|---|---|
| https://github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5 | Patch |
| https://github.com/bonitasoft/bonita-connector-webservice/pull/17 | Patch |
| https://github.com/bonitasoft/bonita-connector-webservice/releases/tag/1.3.1 | Release Notes |
| https://vuldb.com/?ctiid.217443 | Third Party Advisory |
| https://vuldb.com/?id.217443 | Third Party Advisory |
| https://github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5 | Patch |
| https://github.com/bonitasoft/bonita-connector-webservice/pull/17 | Patch |
| https://github.com/bonitasoft/bonita-connector-webservice/releases/tag/1.3.1 | Release Notes |
| https://vuldb.com/?ctiid.217443 | Third Party Advisory |
| https://vuldb.com/?id.217443 | Third Party Advisory |
Configurations
History
21 Nov 2024, 05:29
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 4.9
v3 : 5.5 |
| References | () https://github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5 - Patch | |
| References | () https://github.com/bonitasoft/bonita-connector-webservice/pull/17 - Patch | |
| References | () https://github.com/bonitasoft/bonita-connector-webservice/releases/tag/1.3.1 - Release Notes | |
| References | () https://vuldb.com/?ctiid.217443 - Third Party Advisory | |
| References | () https://vuldb.com/?id.217443 - Third Party Advisory |
20 Oct 2023, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 is able to address this issue. The patch is named a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443. |
Information
Published : 2023-01-05 10:15
Updated : 2024-11-21 05:29
NVD link : CVE-2020-36640
Mitre link : CVE-2020-36640
CVE.ORG link : CVE-2020-36640
JSON object : View
Products Affected
bonitasoft
- webservice_connector
CWE
CWE-611
Improper Restriction of XML External Entity Reference