CVE-2019-20191: 
Oxygen XML Author vulnerability analysis and mitigation

Oxygen XML Editor 21.1.1 was found to be vulnerable to XML External Entity (XXE) attacks, identified as CVE-2019-20191. The vulnerability was discovered by Pablo Santiago and published on January 13, 2020. This security flaw affects versions 21.1.1 and earlier of the Oxygen XML Editor, which is a comprehensive XML authoring and development tool available across multiple platforms (Medium Blog).

The vulnerability allows XXE attacks through improper configuration of the XML parser, enabling the reading of arbitrary files on the system. The attack can be executed by creating a malicious XML file with external entity references that the vulnerable parser processes (Medium Blog).

When exploited, this vulnerability could lead to the disclosure of confidential data, denial of service, server-side request forgery, and port scanning from the perspective of the machine where the parser is located. The primary risk is that a malicious user could generate a malicious XML to read files in the system (Medium Blog).

The vulnerability has been acknowledged by Oxygen XML Editor, and an advisory was published under reference SYNC-2019-111401 (Medium Blog).