CVE-2021-29620 XXE vulnerability on Launch import with externally-defined DTD file
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2021-29620?
CVE-2021-29620 is a high-severity vulnerability in reportportal, published on 23 Jun 2021.
Official description
Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. This will be resolved in the 5.4.0 release.
Weakness: CWE-611
Which versions are affected by CVE-2021-29620?
2 open source packages ship an affected version, including com.epam.reportportal:service-api. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.epam.reportportal:service-api Maven | From 3.1.0 | 5.4.0 |
com.epam.reportportal:service-api Maven | From 3.1.0 | 5.4.0 |
Products include Reportportal Service-Api.
How do I fix CVE-2021-29620?
Upgrade com.epam.reportportal:service-api to 5.4.0 or later.
Is CVE-2021-29620 being exploited?
There is no known exploitation of CVE-2021-29620 in the wild and no public exploit code.
Other vulnerabilities in reportportal
Sources
Also known as GHSA-24wf-7vf2-pv59.