Description

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Remediation

References

https://issues.apache.org/jira/browse/XMLBEANS-517

https://lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed%40%3Cjava-dev.axis.apache.org%3E

https://lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1%40%3Cjava-dev.axis.apache.org%3E

https://lists.debian.org/debian-lts-announce/2021/06/msg00024.html

https://poi.apache.org/

https://security.netapp.com/advisory/ntap-20210513-0004/

https://www.oracle.com/security-alerts/cpujul2022.html

https://www.oracle.com/security-alerts/cpuoct2021.html

Related Vulnerabilities

CVE-2023-37905 Vulnerability in npm package ckeditor-wordcount-plugin

CVE-2023-30513 Vulnerability in maven package org.csanchez.jenkins.plugins:kubernetes

CVE-2021-4264 Vulnerability in maven package org.webjars.npm:dustjs-linkedin

CVE-2021-33900 Vulnerability in maven package org.apache.directory.studio:org.apache.directory.studio.parent

CVE-2020-22755 Vulnerability in maven package net.mingsoft:ms-mcms

Severity

Critical

Classification

CWE-776 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Tags

Issue Tracking Vendor Advisory Mailing List Third Party Advisory Product Patch