Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1jNDl2LTM1ZmYtcTlmN84AAmAg

DotPlant2 Improper Restriction of XML External Entity Reference

An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Permalink: https://github.com/advisories/GHSA-c49v-35ff-q9f7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jNDl2LTM1ZmYtcTlmN84AAmAg
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: 5 months ago


CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-c49v-35ff-q9f7, CVE-2020-25750
References: Repository: https://github.com/DevGroup-ru/dotplant2
Blast Radius: 2.3

Affected Packages

packagist:devgroup/dotplant
Dependent packages: 0
Dependent repositories: 2
Downloads: 8,525 total
Affected Version Ranges: < 2020-09-14
Fixed in: 2020-09-14
All affected versions:
All unaffected versions: 0.0.1, 0.0.2, 0.0.3, 0.0.4, 1.0.0