GitHub Advisoryadvisory · Maven

GHSA-4cf2-cxp3-rjr7 HAPI FHIR XML External Entity (XXE) vulnerability

HIGH Published 2024-11-05 Modified 2024-11-06 Official page ↗
Aliases
CVE-2024-51132
Ecosystem
Maven
Packages
ca.uhn.hapi.fhir:org.hl7.fhir.convertors, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may, ca.uhn.hapi.fhir:org.hl7.fhir.dstu3, ca.uhn.hapi.fhir:org.hl7.fhir.r4, ca.uhn.hapi.fhir:org.hl7.fhir.r4b, ca.uhn.hapi.fhir:org.hl7.fhir.r5, ca.uhn.hapi.fhir:org.hl7.fhir.utilities, ca.uhn.hapi.fhir:org.hl7.fhir.validation
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-601, CWE-611
Reviewed
2024-11-05

Affected packages

• Maven ca.uhn.hapi.fhir:org.hl7.fhir.convertors: < 6.4.0 → fixed in 6.4.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu2: < 6.4.0 → fixed in 6.4.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may: < 6.4.0 → fixed in 6.4.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu3: < 6.4.0 → fixed in 6.4.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.r4: < 6.4.0 → fixed in 6.4.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.r4b: < 6.4.0 → fixed in 6.4.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.r5: < 6.4.0 → fixed in 6.4.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.utilities: < 6.4.0 → fixed in 6.4.0 • Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation: < 6.4.0 → fixed in 6.4.0

Description

An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.

Related

Alias · CVE (1)

  • CVE-2024-51132 An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary… vulnerability

Weakness · CWE (2)

  • CWE-601 URL Redirection to Untrusted Site weakness
  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References