CVE-2019-10782 XML external entity (XXE) processing ('external-parameter-entities' feature was not fully disabled))
An XML External Entity vulnerability in Checkstyle allows attackers to read sensitive files or cause denial of service via crafted XML input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10782?
CVE-2019-10782 is a medium-severity vulnerability in com.puppycrawl.tools:checkstyle, published on 30 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix for CVE-2019-9658.
Weakness: CWE-611
Which versions are affected by CVE-2019-10782?
2 open source packages ship an affected version, including com.puppycrawl.tools:checkstyle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.puppycrawl.tools:checkstyle Maven | All versions | 8.29 |
com.puppycrawl.tools:checkstyle Maven | All versions | 8.29 |
Products include Checkstyle Checkstyle.
How do I fix CVE-2019-10782?
Upgrade com.puppycrawl.tools:checkstyle to 8.29 or later.
Is CVE-2019-10782 being exploited?
There is no known exploitation of CVE-2019-10782 in the wild and no public exploit code.
Other vulnerabilities in com.puppycrawl.tools:checkstyle
Sources
Also known as DEBIAN-CVE-2019-10782, DLA-2099-1, GHSA-763g-fqq7-48wg, SNYK-JAVA-COMPUPPYCRAWLTOOLS-543266, UBUNTU-CVE-2019-10782.