Critical severityNVD Advisory· Published Jan 5, 2023· Updated Apr 10, 2025
bonitasoft bonita-connector-webservice SecureWSConnector.java TransformerConfigurationException xml external entity reference
CVE-2020-36640
Description
A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 is able to address this issue. The patch is named a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.bonitasoft.connectors:bonita-connector-webserviceMaven | < 1.3.1 | 1.3.1 |
Affected products
2- Range: 1.0
Patches
Vulnerability mechanics
References
7- github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5ghsapatchWEB
- github.com/bonitasoft/bonita-connector-webservice/releases/tag/1.3.1ghsapatchWEB
- github.com/advisories/GHSA-wg99-5vrx-j2ggghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-36640ghsaADVISORY
- github.com/bonitasoft/bonita-connector-webservice/pull/17ghsaissue-trackingWEB
- vuldb.comghsasignaturepermissions-requiredWEB
- vuldb.comghsavdb-entrytechnical-descriptionWEB
News mentions
0No linked articles in our index yet.