Apache Cocoon
Monthly
Unauthenticated information disclosure in Apache Cocoon can expose diagnostic interfaces, cache-triggering operations, verbose debug logging, and profile information to any user who can reach those endpoints; all versions are affected. The project is retired and no vendor fix is planned, so exposure is limited to deployments that leave diagnostic/debug endpoints accessible beyond trusted networks. No public exploit code or CISA KEV entry was identified at time of analysis.
Apache Cocoon (all versions, retired/unsupported) can expose one user's cached sensitive content to another user when caching is enabled in a multi-user deployment, due to shared cache entries that are not sufficiently isolated per user (CWE-524). The exposure is opportunistic rather than deterministic: a network attacker cannot force a specific victim's data into the cache, and only applications that actually cache sensitive per-user output are at risk. No public exploit code was identified at time of analysis, the CVE is not in CISA KEV, and the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N with no vendor patch because the project is retired.
Unauthenticated SQL injection in Apache Cocoon affects all versions when a deployment uses the SQL processor or sql:/esql: logicsheets and passes attacker-controllable input into those SQL pipelines. A remote attacker who can reach such a pipeline could compromise data confidentiality, integrity, and availability, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector. The project is retired with no planned fix, no public exploit identified at time of analysis, and no CISA KEV entry; exposure is limited to instances that actually use the vulnerable SQL features and expose them to untrusted users.
XML external entity expansion in Apache Cocoon's fp: form processor lets unauthenticated remote attackers submit crafted XML that triggers server-side request forgery and can expose server files to an external system. All Cocoon versions are affected, and because the project is retired the vendor has stated it will not release a fix; exploitation requires a reachable form-processing endpoint that parses attacker-supplied XML. No public exploit identified at time of analysis, and the independent assessment rates confidentiality impact High with scope changed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
Unauthenticated information disclosure in Apache Cocoon can expose diagnostic interfaces, cache-triggering operations, verbose debug logging, and profile information to any user who can reach those endpoints; all versions are affected. The project is retired and no vendor fix is planned, so exposure is limited to deployments that leave diagnostic/debug endpoints accessible beyond trusted networks. No public exploit code or CISA KEV entry was identified at time of analysis.
Apache Cocoon (all versions, retired/unsupported) can expose one user's cached sensitive content to another user when caching is enabled in a multi-user deployment, due to shared cache entries that are not sufficiently isolated per user (CWE-524). The exposure is opportunistic rather than deterministic: a network attacker cannot force a specific victim's data into the cache, and only applications that actually cache sensitive per-user output are at risk. No public exploit code was identified at time of analysis, the CVE is not in CISA KEV, and the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N with no vendor patch because the project is retired.
Unauthenticated SQL injection in Apache Cocoon affects all versions when a deployment uses the SQL processor or sql:/esql: logicsheets and passes attacker-controllable input into those SQL pipelines. A remote attacker who can reach such a pipeline could compromise data confidentiality, integrity, and availability, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector. The project is retired with no planned fix, no public exploit identified at time of analysis, and no CISA KEV entry; exposure is limited to instances that actually use the vulnerable SQL features and expose them to untrusted users.
XML external entity expansion in Apache Cocoon's fp: form processor lets unauthenticated remote attackers submit crafted XML that triggers server-side request forgery and can expose server files to an external system. All Cocoon versions are affected, and because the project is retired the vendor has stated it will not release a fix; exploitation requires a reachable form-processing endpoint that parses attacker-supplied XML. No public exploit identified at time of analysis, and the independent assessment rates confidentiality impact High with scope changed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).