Description
Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.
Remediation
References
https://github.com/liquibase/liquibase/commit/33d9d925082097fb1a3d2fc8e44423d964cd9381
https://huntr.dev/bounties/f1ae5779-b406-4594-a8a3-d089c68d6e70
https://www.oracle.com/security-alerts/cpujul2022.html
http://seclists.org/fulldisclosure/2025/Apr/14
Related Vulnerabilities
CVE-2008-6504 Vulnerability in maven package org.apache.struts:struts2-core
CVE-2022-31367 Vulnerability in npm package strapi
CVE-2022-36907 Vulnerability in maven package org.jenkins-ci.plugins:openshift-deployer
CVE-2021-37695 Vulnerability in maven package org.webjars.npm:ckeditor4
CVE-2020-36185 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind