Vulnerabilities > CVE-2020-25020 - XXE vulnerability in multiple products

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

mpxj

oracle

CWE-611

critical

NVD

Published: 2020-08-29

Updated: 2022-09-02

Summary

MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components.

Vulnerable Configurations

Part	Description	Count
Application	Mpxj Mpxj Mpxj 0.1.0 Mpxj Mpxj 0.2.0 Mpxj Mpxj 0.3.0 Mpxj Mpxj 0.4.0 Mpxj Mpxj 0.5.0 Mpxj Mpxj 4.7.6 Mpxj Mpxj 5.0.0 Mpxj Mpxj 5.1.0 Mpxj Mpxj 5.1.1 Mpxj Mpxj 5.1.2 Mpxj Mpxj 5.1.3 Mpxj Mpxj 5.1.4 Mpxj Mpxj 5.1.6 Mpxj Mpxj 5.1.7 Mpxj Mpxj 5.1.8 Mpxj Mpxj 5.1.9 Mpxj Mpxj 5.1.10 Mpxj Mpxj 5.1.11 Mpxj Mpxj 5.1.12 Mpxj Mpxj 5.1.13 Mpxj Mpxj 5.1.14 Mpxj Mpxj 5.1.15 Mpxj Mpxj 5.1.16 Mpxj Mpxj 5.1.17 Mpxj Mpxj 5.1.18 Mpxj Mpxj 5.2.0 Mpxj Mpxj 5.2.1 Mpxj Mpxj 5.2.2 Mpxj Mpxj 5.3.0 Mpxj Mpxj 5.3.1 Mpxj Mpxj 5.3.2 Mpxj Mpxj 5.3.3 Mpxj Mpxj 5.4.0 Mpxj Mpxj 5.5.0 Mpxj Mpxj 5.5.1 Mpxj Mpxj 5.5.2 Mpxj Mpxj 5.5.3 Mpxj Mpxj 5.5.4 Mpxj Mpxj 5.5.5 Mpxj Mpxj 5.5.6 Mpxj Mpxj 5.5.7 Mpxj Mpxj 5.5.8 Mpxj Mpxj 5.5.9 Mpxj Mpxj 5.6.0 Mpxj Mpxj 5.6.1 Mpxj Mpxj 5.6.2 Mpxj Mpxj 5.6.3 Mpxj Mpxj 5.6.4 Mpxj Mpxj 5.6.5 Mpxj Mpxj 5.7.0 Mpxj Mpxj 5.7.1 Mpxj Mpxj 5.8.0 Mpxj Mpxj 5.9.0 Mpxj Mpxj 5.10.0 Mpxj Mpxj 5.11.0 Mpxj Mpxj 5.12.0 Mpxj Mpxj 5.13.0 Mpxj Mpxj 5.14.0 Mpxj Mpxj 6.0.0 Mpxj Mpxj 6.1.0 Mpxj Mpxj 6.1.1 Mpxj Mpxj 6.1.2 Mpxj Mpxj 6.2.0 Mpxj Mpxj 6.2.1 Mpxj Mpxj 7.0.0 Mpxj Mpxj 7.0.1 Mpxj Mpxj 7.0.2 Mpxj Mpxj 7.0.3 Mpxj Mpxj 7.1.0 Mpxj Mpxj 7.2.0 Mpxj Mpxj 7.2.1 Mpxj Mpxj 7.3.0 Mpxj Mpxj 7.4.0 Mpxj Mpxj 7.4.1 Mpxj Mpxj 7.4.2 Mpxj Mpxj 7.4.3 Mpxj Mpxj 7.4.4 Mpxj Mpxj 7.5.0 Mpxj Mpxj 7.6.0 Mpxj Mpxj 7.6.1 Mpxj Mpxj 7.6.2 Mpxj Mpxj 7.6.3 Mpxj Mpxj 7.7.0 Mpxj Mpxj 7.7.1 Mpxj Mpxj 7.8.0 Mpxj Mpxj 7.8.1 Mpxj Mpxj 7.8.2 Mpxj Mpxj 7.8.3 Mpxj Mpxj 7.8.4 Mpxj Mpxj 7.9.0 Mpxj Mpxj 7.9.1 Mpxj Mpxj 7.9.2 Mpxj Mpxj 7.9.3 Mpxj Mpxj 7.9.4 Mpxj Mpxj 7.9.5 Mpxj Mpxj 7.9.6 Mpxj Mpxj 7.9.7 Mpxj Mpxj 7.9.8 Mpxj Mpxj 8.0.0 Mpxj Mpxj 8.0.2 Mpxj Mpxj 8.0.3 Mpxj Mpxj 8.0.4 Mpxj Mpxj 8.0.5 Mpxj Mpxj 8.0.6 Mpxj Mpxj 8.0.7 Mpxj Mpxj 8.0.8 Mpxj Mpxj 8.1.0 Mpxj Mpxj 8.1.1 Mpxj Mpxj 8.1.2 Mpxj Mpxj 8.1.3	202
Application	Oracle Oracle Primavera Unifier 16.2 Oracle Primavera Unifier 16.1 Oracle Primavera Unifier 18.8 Oracle Primavera Unifier 17.7 Oracle Primavera Unifier 17.8 Oracle Primavera Unifier 17.9 Oracle Primavera Unifier 17.10 Oracle Primavera Unifier 17.11 Oracle Primavera Unifier 17.12 Oracle Primavera Unifier 19.12 Oracle Primavera Unifier 20.12	11

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References