CVE-2021-29620

    Dashboard / Vulnerabilities / CVE-2021-29620

    CVE-2021-29620

    Published: 23 Jun 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. This will be resolved in the 5.4.0 release.

    References: https://mvnrepository.com/artifact/com.epam.reportportal/service-api, https://github.com/reportportal/reportportal/security/advisories/GHSA-24wf-7vf2-pv59, https://github.com/reportportal/service-api/pull/1392

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- f9a125e8757f8bd274f364a039cf3d866884d69c
    Fixed -00db4e4ef85344e4b483cd384907285574058e50

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-29620 | CVE-DB