Description
drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.
Remediation
References
https://github.com/kiegroup/drools/pull/3808
Related Vulnerabilities
CVE-2023-45280 Vulnerability in maven package org.yamcs:yamcs-core
CVE-2020-11979 Vulnerability in maven package org.apache.ant:ant
CVE-2020-24025 Vulnerability in npm package node-sass
CVE-2022-28220 Vulnerability in maven package org.apache.james:james-server-protocols-imap4
CVE-2023-29216 Vulnerability in maven package org.apache.linkis:linkis-engineplugin-jdbc