What is GHSA-77cc-w3wm-6whp?

GHSA-77cc-w3wm-6whp is a security advisory published by GitHub Security Advisories with Critical severity. dssp vulnerable to Improper Restriction of XML External Entity Reference

Which CVE IDs does GHSA-77cc-w3wm-6whp cover?

GHSA-77cc-w3wm-6whp covers the following CVE IDs: CVE-2016-15011. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-77cc-w3wm-6whp?

GHSA-77cc-w3wm-6whp has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-77cc-w3wm-6whp?

GHSA-77cc-w3wm-6whp affects 1 product, including: maven/be.e_contract.dssp:dssp-client:\u003c 1.3.2.

GHSA-77cc-w3wm-6whpCriticalCVSS 9.8

dssp vulnerable to Improper Restriction of XML External Entity Reference

Vendor

GitHub Security Advisories

Published

January 6, 2023

Last Modified

October 20, 2023

🔗 CVE IDs covered (1)

CVE-2016-15011 →

📋 Description

A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function checkSignResponse of the file dssp-client/src/main/java/be/e_contract/dssp/client/SignResponseVerifier.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.2 can address this issue. The name of the patch is ec4238349691ec66dd30b416ec6eaab02d722302. It is recommended to upgrade the affected component. The identifier VDB-217549 was assigned to this vulnerability.

🎯 Affected products1

maven/be.e_contract.dssp:dssp-client:< 1.3.2

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2016-15011
https://github.com/e-Contract/dssp/commit/ec4238349691ec66dd30b416ec6eaab02d722302
https://github.com/e-Contract/dssp/releases/tag/dssp-1.3.2
https://vuldb.com/?ctiid.217549
https://vuldb.com/?id.217549
https://github.com/advisories/GHSA-77cc-w3wm-6whp