PT-2019-19891
CVE-2019-9843
·
تاريخ النشر
2019-03-15
·
تاريخ التحديث
2021-07-02
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
DiffPlug Spotless versions prior to 1.20.0 (library and Maven plugin)
DiffPlug Spotless versions prior to 3.20.0 (Gradle plugin)
Description
The issue allows disclosure of file contents to a man-in-the-middle (MITM) attacker when a victim performs a spotlessApply operation on an untrusted XML file. This is due to the XML parser resolving external entities over both HTTP and HTTPS and not respecting the resolveExternalEntities setting.
Recommendations
For versions prior to 1.20.0 (library and Maven plugin), update to version 1.20.0 or later.
For versions prior to 3.20.0 (Gradle plugin), update to version 3.20.0 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾