CVE-2019-5427CWE-776

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion…

published April 22, 2019

CVSS
—
EPSS
5%
Percentile
92.0
In the wild
Unconfirmed
What it is

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04882 · 92.0th percentile
Weakness
CWE-776 · Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Published
2019-04-22T20:52Z
EPSS history
Timeline
  • 22 APR 20:52Z
    c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion…
    cvelistv5