Description
drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.
Remediation
References
https://github.com/kiegroup/drools/pull/3808
Related Vulnerabilities
CVE-2010-1330 Vulnerability in maven package org.jruby.jcodings:jcodings
CVE-2023-43794 Vulnerability in npm package nocodb
CVE-2018-20821 Vulnerability in npm package node-sass
CVE-2014-7810 Vulnerability in maven package org.apache.tomcat:tomcat-el-api
CVE-2021-43812 Vulnerability in npm package @auth0/nextjs-auth0