CVE-2020-10990: 
NixOS vulnerability analysis and mitigation

An XML External Entity (XXE) vulnerability was discovered in Accenture Mercury before version 1.12.28, specifically in the platformlambda/core/serializers/SimpleXmlParser.java component. The vulnerability was identified and reported in January 2020 (Mercury Issue, Mercury Commit).

The vulnerability exists in the SimpleXmlParser component of Accenture Mercury's core serializers. XXE vulnerabilities typically occur when XML input containing a reference to an external entity is processed by a weakly configured XML parser, which could allow an attacker to disclose internal files or perform server-side request forgery.

XML External Entity (XXE) vulnerabilities can potentially lead to disclosure of confidential data, denial of service, server-side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.

The vulnerability was patched in Accenture Mercury version 1.12.28, released on January 8, 2020. The fix involved updating the SimpleXmlParser with XML External Entity (XXE) injection prevention measures (Mercury Commit). Users should upgrade to version 1.12.28 or later to receive the security fix.