github.com
https://github.com/bonitasoft/bonita-connector-webservice CVE-2020-36640
MEDIUM
bonitasoft bonita-connector-webservice SecureWSConnector.java TransformerConfigurationException xml external entity reference
Record summary
CVE-2020-36640 has a selected CVSS score of 5.5 (medium).
Description
A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 is able to address this issue. The patch is named a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 10, 2025 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
bonita-connector-webserviceBrowse bonitasoft / bonita-connector-webservice | CVE List | 1.0 | affected |
| 1.1 | affected | ||
| 1.2 | affected | ||
| 1.3 | affected | ||
org.bonitasoft.connectors:bonita-connector-webserviceBrowse Maven / org.bonitasoft.connectors:bonita-connector-webservice | GitHub Advisory | Before 1.3.1 · Fixed in 1.3.1 | affected |
References
7github.compatch
https://github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5 github.comissue tracking
https://github.com/bonitasoft/bonita-connector-webservice/pull/17 github.compatch
https://github.com/bonitasoft/bonita-connector-webservice/releases/tag/1.3.1 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2020-36640 vuldb.comsignaturepermissions required
https://vuldb.com/?ctiid.217443 vuldb.comvdb entryTechnical description
https://vuldb.com/?id.217443