Severity
High
Analysis Summary
CVE-2023-49733 CVSS:7.5
Apache Cocoon could allow a remote attacker to obtain sensitive information, caused by improper handling of XML external entity (XXE) declarations by the StreamGenerator function. By using specially crafted XML content, a remote attacker could exploit this vulnerability to read arbitrary files on the server.
CVE-2023-45135 CVSS:6.5
Apache Cocoon is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the DatabaseCookieAuthenticatorAction, which could allow the attacker to view, add, modify or delete information in the back-end database.
Impact
- Information Disclosure
- Data Manipulation
Indicators Of Compromise
CVE
- CVE-2023-49733
- CVE-2023-45135
Affected Vendors
Apache
Affected Products
- Apache Cocoon 2.2
Remediation
Upgrade to the latest version of Apache Cocoon, available from the Apache Website.