#VU20401 XML External Entity Reference in Apache Santuario XML Security for Java - CVE-2019-12400

Vulnerability identifier: #VU20401

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-12400

CWE-ID: CWE-611

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Apache Santuario XML Security for Java
Universal components / Libraries / Libraries used by multiple products

Vendor: Apache Foundation

Description

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to the loading of XML parsing code from an untrusted source. A remote attacker can exploit this vulnerability to launch further attacks on the system when validating signed documents. 

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Apache Santuario XML Security for Java: 2.0.3 - 2.0.11, 2.1.0 - 2.1.3

---

External links
https://santuario.apache.org/secadv.data/CVE-2019-12400.asc?version=1&modificationDate=1566573083000&api=v2

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.