← Back

CVE-2019-5427

nvd nist
Published: Apr 22, 2019Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

Affected (19)

Mchange
1 product
C3p0
Fedoraproject
1 product
Fedora
Oracle
9 products
Communications Ip Service Activator
Communications Session Route Manager
Documaker
Enterprise Manager Base Platform
Enterprise Manager Ops Center
Flexcube Private Banking
Hyperion Infrastructure Technology
Retail Xstore Point Of Service
Webcenter Sites
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
C3p0
Before 0.9.5.4
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Fedoraproject
Fedora
Version 29
Fedora
Version 30
Configuration C
16 vulnerable
Vulnerable SoftwareAffected Versions
Oracle
Communications Ip Service Activator
Version 7.3.0
Communications Ip Service Activator
Version 7.4.0
Communications Session Route Manager
From 8.2.0 to 8.2.2
Documaker
From 12.6.0 to 12.6.6
Enterprise Manager Base Platform
Version 13.2.1.0
Enterprise Manager Ops Center
Version 12.4.0.0
Oracle
Flexcube Private Banking
Version 12.0.0
Flexcube Private Banking
Version 12.1.0
Hyperion Infrastructure Technology
Version 11.1.2.4
Oracle
Retail Xstore Point Of Service
Version 15.0
Retail Xstore Point Of Service
Version 16.0
Retail Xstore Point Of Service
Version 17.0
Retail Xstore Point Of Service
Version 18.0
Retail Xstore Point Of Service
Version 19.0
Oracle
Webcenter Sites
Version 12.2.1.3.0
Webcenter Sites
Version 12.2.1.4.0

Related CWEs

CWE-776
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References (16)

Source: support@hackerone.com
ExploitIssue TrackingPatchThird Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.