CVE-2020-13692: 
Java vulnerability analysis and mitigation

CVE-2020-13692 is a vulnerability discovered in PostgreSQL JDBC Driver (PgJDBC) versions prior to 42.2.13. The vulnerability was identified as an XML External Entity (XXE) weakness that could potentially expose sensitive information (CVE Database, Red Hat Portal).

The vulnerability is related to XML processing in the PostgreSQL JDBC driver where external entity processing was not properly restricted. The issue received a CVSS v3.1 score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a severe security risk (NetApp Security).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The high severity rating indicates significant potential impact on system security (NetApp Security).

The vulnerability was publicly disclosed and discussed, though there are no confirmed reports of active exploitation in the wild. The critical CVSS score indicates that the vulnerability is relatively easy to exploit, requiring no special privileges or user interaction (NetApp Security).

The vulnerability was fixed in PostgreSQL JDBC Driver version 42.2.13. Users are advised to upgrade to this version or later. For systems that cannot be immediately upgraded, the fix involves disabling external access and doctypes in XML processing. The legacy insecure behavior can be restored via the new connection property xmlFactoryFactory with a value of LEGACY_INSECURE (GitHub Commit).