VULNERABILITY INTELLIGENCE
CVE-2019-9843
CVSS score7.5 HIGH
EPSS probability1.50%
CISA KEVNot currently listed
Published2019-06-28
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.
Weakness classification
- CWE-611: Improper Restriction of XML External Entity Reference
Primary references
- cve@mitre.org — Release Notes, Third Party Advisory
- cve@mitre.org — Release Notes, Third Party Advisory
- cve@mitre.org — Issue Tracking, Third Party Advisory
- cve@mitre.org — Issue Tracking, Third Party Advisory
- cve@mitre.org
- af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108