Description

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Remediation

References

https://issues.apache.org/jira/browse/XMLBEANS-517

https://lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed%40%3Cjava-dev.axis.apache.org%3E

https://lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1%40%3Cjava-dev.axis.apache.org%3E

https://lists.debian.org/debian-lts-announce/2021/06/msg00024.html

https://poi.apache.org/

https://security.netapp.com/advisory/ntap-20210513-0004/

https://www.oracle.com/security-alerts/cpujul2022.html

https://www.oracle.com/security-alerts/cpuoct2021.html

Related Vulnerabilities

CVE-2022-25301 Vulnerability in npm package jsgui-lang-essentials

CVE-2022-25867 Vulnerability in maven package io.socket:socket.io-client

CVE-2023-26475 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore

CVE-2020-5407 Vulnerability in maven package org.springframework.security:spring-security-saml2-service-provider

CVE-2017-12617 Vulnerability in maven package org.apache.tomcat:tomcat-catalina

Severity

Critical

Classification

CWE-776 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Tags

Issue Tracking Vendor Advisory Mailing List Third Party Advisory Product Patch