CVE-2020-11991

Published: Sep 11, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system.

Affected (1)

Products: Apache: Cocoon

Apache

1 product

Cocoon

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Cocoon	From 2.1 to 2.1.12

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

https://lists.apache.org/thread.html/r77add973ea521185e1a90aca00ba9dae7caa8d8b944d92421702bb54%40%3Cusers.cocoon.apache.org%3E

Source: security@apache.org

ExploitMailing ListVendor Advisory

https://lists.apache.org/thread.html/r77add973ea521185e1a90aca00ba9dae7caa8d8b944d92421702bb54%40%3Cusers.cocoon.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListVendor Advisory

Timeline

No history available yet.