cocoon CVEs | Waratek

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 2 100.0% Withdrawn CVE 0 0.0%

Critical 0 0.0% High 1 50.0% Medium 1 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 2 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 1 50.0% Working exploit published 1 50.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%

split by StatusSeverityProtectionExploit maturity peak 1 / year

20031 Not applicable1 Medium1 not blocked1 Working exploit published1 20040 20050 20060 20070 20080 20090 20100 20110 20120 20130 20140 20150 20160 20170 20180 20190 20201 Not applicable1 High1 not blocked1 Exploited1

200420062008201020122014201620182020

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2020-11991	High	2020-09-11	Not applicable	Exploited	When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system.
CVE-2003-1172	Medium	2003-12-31	Not applicable	Working exploit published	Directory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoon 2.1 and 2.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the filename parameter.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2020-11991

High

2020-09-11

Not applicable

Exploited

When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any file on the server system.

CVE-2003-1172

Medium

2003-12-31

Not applicable

Working exploit published

Directory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoon 2.1 and 2.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the filename parameter.