Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
XXE vulnerability on Launch import with externally-defined DTD file
Vulnerability Description
Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. This will be resolved in the 5.4.0 release.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Vulnerability Title
Epam Systems Report Portal 代码问题漏洞
Vulnerability Description
Epam Systems Report Portal是美国EPAM Systems（Epam Systems）公司的一套开源的自动化测试工具，它支持获取、汇总和分析测试结果和报告。service-api是其中的一个API（应用程序编程接口）。 Report Portal service-api存在安全漏洞，该漏洞没有正确配置XML解析器来防止XML外部实体(XXE)攻击。
CVSS Information
N/A
Vulnerability Type
N/A