CVE-2019-9843

Severity Score

7.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.

En DiffPlug Spotless en versiones anteriores a 1.20.0 (library and Maven plugin) y anteriores a 3.20.0 (Gradle plugin), el analizador XML resolvería las entidades externas a través de HTTP y HTTPS y no respetaría la configuración de resolución de entidades externas. Por ejemplo, esto permite la divulgación del contenido del archivo a un atacante MITM si una víctima realiza una operación spotlessApply en un archivo XML que no es de confianza.

*Credits: N/A

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

High

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-03-15 CVE Reserved
2019-03-15 CVE Published
2024-08-04 CVE Updated
2024-08-05 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-611: Improper Restriction of XML External Entity Reference

CAPEC

References (5)

URL	Tag	Source
https://github.com/diffplug/spotless/blob/master/plugin-gradle/CHANGES.md#version-3200---march-11th-2018-javadoc-jcenter	Release Notes
https://github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.md#version-1200---march-14th-2018-javadoc-jcenter	Release Notes
https://github.com/diffplug/spotless/issues/358	Issue Tracking
https://github.com/diffplug/spotless/pull/369	Issue Tracking
https://lists.apache.org/thread.html/r7406e297228c42deeecdd12a576e39d63073faebf14b027b7608fdfd%40%3Cissues.iceberg.apache.org%3E	Mailing List

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Diffplug Search vendor "Diffplug"		Gradle Search vendor "Diffplug" for product "Gradle"				< 3.20.0 Search vendor "Diffplug" for product "Gradle" and version " < 3.20.0"		spotless		Affected
Diffplug Search vendor "Diffplug"		Maven Search vendor "Diffplug" for product "Maven"				< 1.20.0 Search vendor "Diffplug" for product "Maven" and version " < 1.20.0"		spotless		Affected