XXE vulnerability on Launch import with externally-defined DTD file

CAO 7.5CVE-2021-29620 · GHSA-24wf-7vf2-pv59 · Công bố 23/06/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-29620 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng com.epam.reportportal:service-api, service-api (reportportal).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 2.2%, cao hơn 82.8% các lỗ hổng khác.
Cách xử lý: cập nhật lên 5.4.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
com.epam.reportportal:service-api Maven	`≥ 3.1.0, < 5.4.0`	`5.4.0`
service-api reportportal	`≥ 3.1.0, < 5.4.0`	`5.4.0`

Mô tả

Impact

Starting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery.

Patches

Fixed with: https://github.com/reportportal/service-api/pull/1392

Binaries

docker pull reportportal/service-api:5.4.0 https://github.com/reportportal/service-api/packages/846871?version=5.4.0

For more information

If you have any questions or comments about this advisory email us: [email protected]

Mô tả của NVD

Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. This will be resolved in the 5.4.0 release.