GHSA-fhj6-gr87-g4cj

XML External Entity Reference in ureport

Source: GitHub Advisory Database (reviewed) High CVE-2023-24187

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.bstek.ureport:ureport2-core	<= 2.2.9	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-24187 advisory
https://github.com/Venus-WQLab/bug_report/blob/main/ureport/ureport-cve-2023-24187.md web
https://github.com/cgddgc/vulns/blob/main/ureport2-vuln-des.md web
https://github.com/youseries/ureport package
http://ureport.com web