{
"id": "GHSA-2jx8-v4hv-gx3h",
"aliases": [
"CVE-2020-12642"
],
"details": "| Release Date | Affected Projects | Affected Versions | Access Vector| Security Risk |\n|--------------|-------------------|-------------------|---------------|---------------|\n| Monday, May 4, 2020| [service-api](https://github.com/reportportal/service-api) | Every version, starting from 3.1.0 | Remote | Medium |\n\n### Impact\nStarting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file that uses external entities for extraction of secrets from Report Portal service-api module or server-side request forgery.\n\nReport Portal versions 4.3.12+ and 5.1.1+ disables external entity resolution for theirs XML parser.\n\nWe advise our users install the latest releases we built specifically to address this issue.\n\n### Patches\nFixed with https://github.com/reportportal/service-api/pull/1201\n\n### Binary Download\nhttps://bintray.com/epam/reportportal/service-api/5.1.1\nhttps://bintray.com/epam/reportportal/service-api/4.3.12\n\n### Docker Container Download\n* RP v4: `docker pull reportportal/service-api:4.3.12`\n* RP v5: `docker pull reportportal/service-api:5.1.1`\n\n### Acknowledgement\nThe issue was reported to Report Portal Team by an external security researcher.\nOur Team thanks Julien M. for reporting the issue.\n\n### For more information\nIf you have any questions or comments about this advisory email us: [[email protected] ](mailto:[email protected] )",
"summary": "XXE vulnerability in Launch import",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "4.3.12"
}
]
}
],
"package": {
"name": "com.epam.reportportal:service-api",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.1.1"
}
]
}
],
"package": {
"name": "com.epam.reportportal:service-api",
"ecosystem": "Maven"
}
}
],
"modified": "2021-10-05T17:29:41Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"published": "2021-06-28T16:45:47Z",
"references": [
{
"url": "https://github.com/reportportal/reportportal/security/advisories/GHSA-2jx8-v4hv-gx3h",
"type": "WEB"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12642",
"type": "ADVISORY"
},
{
"url": "https://github.com/reportportal/service-api/pull/1201",
"type": "WEB"
},
{
"url": "https://github.com/reportportal/service-api/commit/da4a012abdcc69f02f4255d81466f1f473b7f418",
"type": "WEB"
},
{
"url": "https://github.com/reportportal/reportportal",
"type": "PACKAGE"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": "2020-05-04T16:15:00Z",
"github_reviewed_at": "2021-06-28T16:45:26Z"
}
}