CVE-2020-36640 json
bonitasoft bonita-connector-webservice SecureWSConnector.java TransformerConfigurationException xml external entity reference
published 2023-01-05 3 y ago modified 2026-06-17 4 mo ago also GHSA-wg99-5vrx-j2gg , EUVD-2023-0573
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 is able to address this issue. The patch is named a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443.
Patch / fix
- maven org.bonitasoft.connectors:bonita-connector-webservice 1.3.1
- bonitasoft webservice_connector 1.3.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.84% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 5.5 | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 4.9 | AV:A/AC:M/Au:S/C:P/I:P/A:P |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.bonitasoft.connectors:bonita-connector-webservice | <1.3.1 |
1.3.1 |
Affected products
- bonitasoft bonita-connector-webservice
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
References
-
github.com
/bonitasoft/bonita-connector-webservice/pull/17
issue-tracking, web, patch
-
github.com
/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5
patch, web
-
github.com
/bonitasoft/bonita-connector-webservice/releases/tag/1.3.1
patch, web, release-notes
-
vuldb.com
/?id.217443
vdb-entry, technical-description, web, third-party-advisory
-
vuldb.com
/?ctiid.217443
signature, permissions-required, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-36640
advisory
-
github.com
/bonitasoft/bonita-connector-webservice
package
Sources
- CVE List CVE-2020-36640
- GitHub Advisory GHSA-wg99-5vrx-j2gg
- NVD CVE-2020-36640
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.