shanika04/cp30_XXE_partial_fix

PoC

version between CVE-2018-20433 and CVE-2019-5427

view exploit source poc_in_githubauthor shanika04published 2020-12-13catalog poc_in_github

exploited CVEs (2)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2019-5427US	high7.5	4.88% (92nd)	Exploit	2019-04-22
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configu…
CVE-2018-20433US	critical9.8	4.59% (92nd)	Exploit	2018-12-24
c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.