Vulnerability Intelligence Report
CVE-2019-5427
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
No Active Exploit Signals
CVSS Base Score
7.5
HIGH
EPSS Probability:4.88%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-776 ↗XML Entity Expansion (CWE-776)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| mchange | c3p0 | all |
| fedoraproject | fedora | 29, 30 |
| oracle | communications_ip_service_activator | 7.3.0, 7.4.0 |
| oracle | communications_session_route_manager | all |
| oracle | documaker | all |
| oracle | enterprise_manager_base_platform | 13.2.1.0 |
| oracle | enterprise_manager_ops_center | 12.4.0.0 |
| oracle | flexcube_private_banking | 12.0.0, 12.1.0 |
| oracle | hyperion_infrastructure_technology | 11.1.2.4 |
| oracle | retail_xstore_point_of_service | 15.0, 16.0, 17.0, 18.0, 19.0 |
| oracle | webcenter_sites | 12.2.1.3.0, 12.2.1.4.0 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
4.882%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | HackerOne · Bug Bounty Provider · USA |
| Reserved | 2019-01-04T00:00:00 |
| Published | 2019-04-22T20:52:56 |
| Patch Date | 2019-04-16 |
| Last Updated | 2024-08-04T19:54:53 |
Community Chatter & Buzz