{"id":"CVE-2020-36640","details":"A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 is able to address this issue. The patch is named a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443.","aliases":["GHSA-wg99-5vrx-j2gg"],"modified":"2026-07-08T12:42:13.997847Z","published":"2023-01-05T10:15:09.773Z","references":[{"type":"ADVISORY","url":"https://github.com/bonitasoft/bonita-connector-webservice/releases/tag/1.3.1"},{"type":"ADVISORY","url":"https://vuldb.com/?ctiid.217443"},{"type":"ADVISORY","url":"https://vuldb.com/?id.217443"},{"type":"FIX","url":"https://github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5"},{"type":"FIX","url":"https://github.com/bonitasoft/bonita-connector-webservice/pull/17"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bonitasoft/bonita-connector-webservice","events":[{"introduced":"0"},{"fixed":"badbcc9672c41aa54c5dc7dfc5d64f35100a886b"},{"fixed":"a12ad691c05af19e9061d7949b6b828ce48815d5"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.3.1"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:bonitasoft:webservice_connector:*:*:*:*:*:*:*:*"}}],"versions":["1.3.0","1.2.5","1.2.4","1.2.3","1.2.2","1.2.1","1.2.0","1.0.13","1.1.0","1.0.12","bonita-connector-webservice-1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-36640.json","vanir_signatures_modified":"2026-07-08T12:42:13Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"126584707425794684538061775401875770174","length":316},"id":"CVE-2020-36640-19718d25","signature_type":"Function","signature_version":"v1","source":"https://github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5","target":{"file":"src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java","function":"getTransformer"}},{"digest":{"function_hash":"313552796009566066289302339322874785076","length":522},"id":"CVE-2020-36640-1fc72dea","signature_type":"Function","signature_version":"v1","source":"https://github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5","target":{"file":"src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java","function":"printRequestAndResponse"},"deprecated":false},{"digest":{"function_hash":"267458609695961726349736944268426503076","length":438},"id":"CVE-2020-36640-c9773df6","signature_type":"Function","signature_version":"v1","source":"https://github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5","target":{"file":"src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java","function":"buildResponseDocumentBody"},"deprecated":false},{"target":{"file":"src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java"},"deprecated":false,"digest":{"line_hashes":["163697624163611354718520866918279155877","211521450840835562923687159630507822365","169101337966354907301146599261922695411","44942050844779701367571242332558126035","209893996525595167237500634111562052082","122525658299918865225096535203428929939","142424452069575045046745149400938347311","215581661556365738805674873643018491720","68906309157889530035351021429690878571","187780757414585957911861364175510583731","339696173983664439629902209949892589709","173237048629573771947489141065826960012","286403414175256202802402723354363626046","140881105738884322814867101718345586657","315894018377179509124053349960177182355","226971092306514866556968356406068046949","251775474226341365665538375484338068709","12357212343353571330490520347215318233","264268226389636019862151607078329918313","210511424120078035997017164574994456516","139012107343402325740411980430855447594","41086633106929466553087059822029024384","232075133933740547040954839662695645473","91262140085448256285351375414231877358","59332222045675953412878431681057536460","94578688514585219573416504258776039529","334916278931244313445997366707587877099","263765754215127007100800665487922423470","294187140196393447486406835504974834879","28372213355564888313174652912343672593","287884008941311912295374650123558481147","119882782263257294084417823331267298397","322976208295205734635971448346403195540","144372527450595859597626570628361150761","53008190142656476483194543972819980321","316003212762725875156716336743874558240","63569033682393650314156361380258146692","91709779764914650137202645312950658942","269081092529661841185995978892954550433","292867114935044710344321495889600319215","123959190501316608232956184779543157349","75445647517720497550802429978883108346","199841776914861916796765804451070683216","266231913211885275687598251882020133929","304942920979019757222155708242962146081","113959828481128084725807826139506543367","139291893707643487277808350591621535931","325013783717915773217790318089547691113","210538652554505329096912874492135581385","310548219515208019640203931497921390585","138782641749501670144113667065214892603","43129060894565993966300101663381836361","270834071272493720250018860414436717035","270354862287946814132370318388193513093","118438122331077885663898506426402316672","5127614259153638929036679225053788727","34271878110485365176463435208071026025","161368792588288194834596510202392703228","186539996055737012136909619129376599966","332339409010896585199646684788791740519","284902551282463839030654111621399393263","283566498192868948218909489449363778932","247161449539465156015507559100473470399","73724559684002499853486264791172852466","148666462390472161317538960039083513058","297491065552851354499540085754691228743","112935841183066223267070594346455485931","251554056188505016480620882779995476630","132819286736208539849460574339368553947","264143160445265478646948838720728920892","190702943556869694637179757000382759836","241379665846879291921482386910597655231","318375960140902274868445689180791668561","11711158611380022906832112880074623419","19504217641701881867800316730937629424","325899539232439682492369078959088125404","220458761034406808752272376599030269188","260457579544105683613798585172483131840","85604165189297324872141894585063421020","275856538651401779136640390608049815310","223263335314621133819089331755795810221","65117931806674119864479608977676646950","228246680312087978428367061380524784751","54293456459335644256328245205953103243","23666570282155498347983460341648148754","41153733291953673054061188991697180327","113186933855904969060800028989637809943","175660888064531740640649603823529880994"],"threshold":0.9},"id":"CVE-2020-36640-f54ecdf8","signature_type":"Line","signature_version":"v1","source":"https://github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}