cbcvebase.

Apache Cocoon vulnerabilities

5 known vulnerabilities affecting apache/cocoon.

Total CVEs
5
CISA KEV
0
Public exploits
2
Exploited in wild
1
Severity breakdown
CRITICAL2HIGH1MEDIUM2

Vulnerabilities

Page 1 of 1
CVE-2020-11991P1HIGHCVSS 7.5ExploitedPoC≥ 2.1, ≤ 2.1.122020-09-11
CVE-2020-11991 [HIGH] CWE-611 CVE-2020-11991: When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, includi When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system.
nvd
CVE-2003-1172P4MEDIUMCVSS 5.0PoCv2.1v2.1.2+1 more2003-12-31
CVE-2003-1172 [MEDIUM] CVE-2003-1172: Directory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoo Directory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoon 2.1 and 2.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the filename parameter.
nvd
CVE-2022-45135P3CRITICALCVSS 9.8≥ 2.2.0, < 2.3.02023-11-30
CVE-2022-45135 [CRITICAL] CWE-89 CVE-2022-45135: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.
nvd
CVE-2023-49733P3CRITICALCVSS 9.8≥ 2.2.0, < 2.3.02023-11-30
CVE-2023-49733 [CRITICAL] CWE-611 CVE-2023-49733: Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affe Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.
nvd
CVE-2024-21530P4MEDIUM≥ 0, < 0.4.02023-10-24
CVE-2024-21530 [MEDIUM] Sequential calls of encryption API (`encrypt`, `wrap`, and `dump`) result in nonce reuse Sequential calls of encryption API (`encrypt`, `wrap`, and `dump`) result in nonce reuse **Problem**: Trying to create a new encrypted message with the same cocoon object generates the same ciphertext. It mostly affects `MiniCocoon` and `Cocoon` objects with custom seeds and RNGs (where `StdRng` is used under the hood). **Note**: The issue does **NOT** affect objects created with **
ghsaosv