Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-12642

CVE-2020-12642: XXE vulnerability in Launch import

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-12642
GHSA ID
GHSA-2jx8-v4hv-gx3h
EPSS Score
0.51025%
CWE
CWE-611
Published
6/28/2021
Updated
2/1/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
com.epam.reportportal:service-apimaven>= 3.1.0, < 4.3.124.3.12
com.epam.reportportal:service-apimaven>= 5.0.0, < 5.1.15.1.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from insecure XML parser configuration in JUnit import handling. The fix in commit da4a012 shows security features were added to SAXParserFactory/XMLReader in XunitParseJob.java. The original vulnerable code executed 'SAXParserFactory.newInstance().newSAXParser().parse()' without disabling external entity resolution, which aligns with CWE-611 (XXE) description. The direct modification of XML parsing logic in this class confirms it as the vulnerable entry point.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

| R*l**s* **t* | *****t** Proj**ts | *****t** V*rsions | ****ss V**tor| S**urity Risk | |--------------|-------------------|-------------------|---------------|---------------| | Mon**y, M*y *, ****| [s*rvi**-*pi](*ttps://*it*u*.*om/r*portport*l/s*rv

Reasoning

T** vuln*r**ility st*ms *rom ins**ur* XML p*rs*r *on*i*ur*tion in JUnit import **n*lin*. T** *ix in *ommit ******* s*ows s**urity ***tur*s w*r* ***** to `S*XP*rs*r***tory`/`XMLR****r` in `XunitP*rs*Jo*.j*v*`. T** ori*in*l vuln*r**l* *o** *x**ut** `'S