XML External Entity Vulnerability in Apache Cocoon StreamGenerator

CVE-2020-11991

Summary

The vulnerability in the StreamGenerator of Apache Cocoon arises from the handling of user-provided XML data, which is subject to external entity processing. By crafting a malicious XML request that exploits this feature, an attacker can potentially gain unauthorized access to sensitive files on the server. This exposes significant risks to server integrity and confidentiality, as it allows the possibility of reading files and executing further attacks.

References