GHSA-7qfm-6m33-rgg9
XML External Entity Reference
GHSA-7qfm-6m33-rgg9 is a high vulnerability (CVSS 7.5) in com.epam.reportportal:service-api, published August 13, 2021. No source lists public exploit code. Fixed in com.epam.reportportal:service-api 4.3.12.
- Severity
- 7.5 HighCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.3.12com.epam.reportportal:service-api +3 more
Description
An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.epam.reportportal:service-apiMaven | before 4.3.12 | 4.3.12 |
com.epam.reportportal:service-apiMaven | 5.0.0 up to 5.1.1 | 5.1.1 |
com.epam.reportportal:service-apiMaven | before 4.3.12, plus listed versions 2.6.02.7.23.0.13.1.13.2.0 Show 7 moreShow less3.2.13.3.24.0.04.1.14.2.14.3.104.3.11 | 4.3.12 |
com.epam.reportportal:service-apiMaven | 5.0.0 up to 5.1.1, plus listed versions 5.1.0 | 5.1.1 |
What each source reports
GitHub Advisories Score used
XML External Entity Reference
An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.
- Record
GHSA-7qfm-6m33-rgg9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
XML External Entity Reference
An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.
- Record
GHSA-7qfm-6m33-rgg9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.