CVE-2019-9843 Information

Description

In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin) the XML parser would resolve external entities over both HTTP and HTTPS and didn’t respect the resolveExternalEntities setting. For example this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.

CVSS Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Reference

https://github.com/diffplug/spotless/blob/master/plugin-gradle/CHANGES.mdversion-3200—march-11th-2018-javadoc-jcenter https://github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.mdversion-1200—march-14th-2018-javadoc-jcenter https://github.com/diffplug/spotless/issues/358 https://github.com/diffplug/spotless/pull/369

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

7.5