XML External Entity injection in jackson-dataformat-xml - CVE-2016-3720

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU27703

XML External Entity injection in jackson-dataformat-xml - CVE-2016-3720

Published: May 12, 2020


Vulnerability identifier: #VU27703
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-3720
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input within the XmlMapper. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.


Affected software

jackson-dataformat-xml
Voice Gateway
z/Transaction Processing Facility ( z/TPF)
openEuler
Fedora
jackson
jackson-help
jackson-dataformat-xml
Cloudera Observability with IBM
StreamSets Data Collector

How to mitigate CVE-2016-3720

Install updates from vendor's website.

jackson-dataformat-xml - update to 2.7.4
Voice Gateway - addressed in versions 1.0.8.17, 1.0.8.18, 1.0.8.24, 1.0.8.29
jackson - update to 1.9.11-16
jackson-help - update to 1.9.11-16
jackson-dataformat-xml - addressed in versions 2.5.0-3.fc22, 2.5.0-3.fc23, 2.6.3-3.fc24
Cloudera Observability with IBM - update to 3.6.2
StreamSets Data Collector - update to 7.0.0

External References

Related Security Bulletins