Description
Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java.
Remediation
References
https://github.com/azkaban/azkaban/issues/2478
Related Vulnerabilities
CVE-2020-7700 Vulnerability in npm package phpjs
CVE-2023-29204 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore
CVE-2023-40573 Vulnerability in maven package org.xwiki.platform:xwiki-platform-scheduler-api
CVE-2021-41862 Vulnerability in maven package com.googlecode.aviator:aviator
CVE-2022-1330 Vulnerability in maven package org.webjars.bower:fullpage