CVE-2018-20433

Published
View on NVD ↗
CVSS v3
N/A
CVSS v2
7.5
HIGH
Affected
1
PROJECT

Description

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

zhutougg/c3p0
zhutougg/c3p0
a mature, highly concurrent JDBC Connection pooling library, with support for caching and reuse of PreparedStatements.
GitHubGitHub