Description
PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets) to perform information disclosure, denial of service, or request forgery attacks. (PMD 6.x is unaffected because of a 2017-09-15 change.)
Remediation
References
https://github.com/pmd/pmd/issues/1650
Related Vulnerabilities
CVE-2020-27219 Vulnerability in maven package org.eclipse.hawkbit:hawkbit-update-server
CVE-2016-5005 Vulnerability in maven package org.apache.archiva:archiva-webapp
CVE-2016-5018 Vulnerability in maven package tomcat:jasper-runtime
CVE-2017-16142 Vulnerability in npm package infraserver
CVE-2021-43090 Vulnerability in maven package com.predic8:soa-model-core