VYPR
← All advisories
High severity7.5NVD Advisory· Published Sep 11, 2020· Updated Jun 17, 2026

CVE-2020-11991

CVE-2020-11991

Description

When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system.

Affected products

2
  • Apache/Cocoon2 versions
    cpe:2.3:a:apache:cocoon:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:cocoon:*:*:*:*:*:*:*:*range: >=2.1,<=2.1.12
    • (no CPE)

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.