GitHub Advisoryadvisory · Maven

GHSA-2363-cqg2-863c XML External Entity (XXE) Injection in JDOM

HIGH Published 2021-07-27 Modified 2025-09-16 Official page ↗
Aliases
CVE-2021-33813
Ecosystem
Maven
Packages
org.jdom:jdom2, org.jdom:jdom
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-611
Reviewed
2021-07-27

Affected packages

• Maven org.jdom:jdom2: < 2.0.6.1 → fixed in 2.0.6.1 • Maven org.jdom:jdom: <= 2.0.2 (no fix yet)

Description

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. As a workaround, to avoid external entities being expanded, one can call `builder.setExpandEntities(false)` and they won't be expanded.

Related

Alias · CVE (1)

  • CVE-2021-33813 An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References