CVEvulnerability

CVE-2025-4949

6.8 MEDIUM Published 2025-05-21 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-05-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 4.0 ([email protected])
6.8 MEDIUM — CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Green
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-611, CWE-827

Description

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.

Affected configurations

• eclipse jgit (< 5.13.4) • eclipse jgit (>= 6.0.0 < 6.10.1.202505221210) • eclipse jgit (>= 7.0.0 < 7.0.1.202505221510) • eclipse jgit (>= 7.1.0 < 7.1.1.202505221757) • eclipse jgit (>= 7.2.0 < 7.2.1.202505142326)

Related

Weakness · CWE (2)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness
  • CWE-827 Improper Control of Document Type Definition weakness

References