GHSA-wcp5-m52f-mhh5
Improper Restriction of XML External Entity Reference in MPXJ
At a glance
- Published
- Updated
- CVE
- CVE-2020-25020
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
"MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components."
Affected packages
| Package | Versions |
|---|---|
| Maven · net.sf.mpxj:mpxj | introduced 0, fixed 8.1.4 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-25020 ADVISORY
- https://github.com/joniles/mpxj/pull/178/commits/c3e457f7a16facfe563eade82b0fa8736a8c96f9 WEB
- https://github.com/joniles/mpxj PACKAGE
- https://github.com/joniles/mpxj/releases/tag/v8.1.4 WEB
- https://www.oracle.com/security-alerts/cpujan2021.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |