CVE Vulnerability

CVE-2021-29620

Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. This will be resolved in the 5.4.0 release.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/reportportal/service-api/pull/1392 Patch Third Party Advisory
https://github.com/reportportal/reportportal/security/advisories/GHSA-24wf-7vf2-pv59 Patch Third Party Advisory
https://mvnrepository.com/artifact/com.epam.reportportal/service-api Release Notes Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:reportportal:service-api:*:*:*:*:*:*:*:*
Information

Published : 2021-06-23 06:15

Updated : 2021-06-30 12:56

NVD link : CVE-2021-29620

Mitre link : CVE-2021-29620

Products Affected
No products.
CWE
CWE-611

Improper Restriction of XML External Entity Reference