Description
An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.
Remediation
References
https://github.com/reportportal/reportportal/blob/master/SECURITY_ADVISORIES.md
Related Vulnerabilities
CVE-2023-31133 Vulnerability in npm package ghost
CVE-2021-3190 Vulnerability in npm package async-git
CVE-2022-28366 Vulnerability in maven package org.codelibs:nekohtml
CVE-2021-33605 Vulnerability in maven package com.vaadin:vaadin-checkbox-flow
CVE-2019-20444 Vulnerability in maven package io.netty:netty-codec-http