CVE-2019-9843

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published
Jun 28, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-98446.1simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI.CVE-2019-98459.8madskristensen Miniblog.Core through 2019-01-16 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, CVE-2019-98468.8RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructsCVE-2019-98477.8A vulnerability in LibreOffice hyperlink processing allows an attacker to construct documents containing hyperlinks pointing to the locationCVE-2019-98489.8LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-ovCVE-2019-98494.3LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This modeCVE-2019-98509.8LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands cCVE-2019-98519.8LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands cCVE-2019-98527.8LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over,CVE-2019-98537.8LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically executionCVE-2019-98547.8LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over,CVE-2019-98559.8LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands c
CVE-2019-9843: High severity, CVSS 7.5 | Vulnix