CVE-2020-6958

An XXE vulnerability in JnlpSupport in Yet Another Java Service Wrapper (YAJSW) 12.14, as used in NSA Ghidra and other products, allows attackers to exfiltrate data from remote hosts and potentially cause denial-of-service.

Score

CVSS 3.1 9.1 Critical

Status

Modified - cve@mitre.org

Published

2020-01-14

Last modified

2024-08-04

Weaknesses

CWE-611

Affected products

• Yet Another Java Service Wrapper (Yet Another Java Service Wrapper Project)

References

• https://github.com/NationalSecurityAgency/ghidra/issues/943
• https://github.com/purpleracc00n/Exploits-and-PoC/blob/master/XXE%20in%20YAJSW%E2%80%99s%20JnlpSupport%20affects%20Ghid…
• https://sourceforge.net/p/yajsw/bugs/166/