Apache Cocoon vulnerabilities
7 known vulnerabilities in Apache Cocoon from Apache. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Apache Cocoon: Exposure of Sensitive System Information to an Unauthorized Control Sphere
** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of (verbose)
- 7.5 High severity
Apache Cocoon: Use of Cache Containing Sensitive Information
** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Ap
- 8.8 High severity
Apache Cocoon: Improper Neutralization of Special Elements used in an SQL Command
** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection th
- 7.5 High severity
Apache Cocoon: Improper Restriction of Recursive Entity References in DTDs
** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exp
- 7.5 High severity
Apache Cocoon: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
** UNSUPPORTED WHEN ASSIGNED ** Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. When a continuation is created, it gets a random identifier. Because the random nu
- 9.8 Critical severity
Apache Cocoon: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.
- 9.8 Critical severity
Apache Cocoon: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.