CVE-2021-29620

Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. This will be resolved in the 5.4.0 release.

• CWE-611
• CWE-611

• https://github.com/reportportal/reportportal/security/advisories/GHSA-24wf-7vf2-pv59Patch, Third Party Advisory
• https://github.com/reportportal/service-api/pull/1392Patch, Third Party Advisory
• https://mvnrepository.com/artifact/com.epam.reportportal/service-apiRelease Notes, Third Party Advisory
• https://github.com/reportportal/reportportal/security/advisories/GHSA-24wf-7vf2-pv59Patch, Third Party Advisory
• https://github.com/reportportal/service-api/pull/1392Patch, Third Party Advisory
• https://mvnrepository.com/artifact/com.epam.reportportal/service-apiRelease Notes, Third Party Advisory

Published

Jun 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29614TensorFlow is an end-to-end open source platform for machine…7.8
• CVE-2021-29615TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-29616TensorFlow is an end-to-end open source platform for machine…7.8
• CVE-2021-29617TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-29618TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-29619TensorFlow is an end-to-end open source platform for machine…5.5
• CVE-2021-29621Flask-AppBuilder is a development framework, built on top of…5.3
• CVE-2021-29622Prometheus is an open-source monitoring system and time seri…6.1
• CVE-2021-29623Exiv2 is a C++ library and a command-line utility to read, w…3.3
• CVE-2021-29624fastify-csrf is an open-source plugin helps developers prote…6.5
• CVE-2021-29625Adminer is open-source database management software. A cross…6.1
• CVE-2021-29626In FreeBSD 13.0-STABLE before n245117, 12.2-STABLE before r3…5.5