GitHub Advisoryadvisory · Maven

GHSA-57qj-79gh-69w8 Improper Restriction of XML External Entity Reference in PMD

HIGH Published 2022-05-14 Modified 2022-06-24 Official page ↗
Aliases
CVE-2019-7722
Ecosystem
Maven
Packages
net.sourceforge.pmd:pmd-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2022-06-24

Affected packages

• Maven net.sourceforge.pmd:pmd-core: < 6.0.0 → fixed in 6.0.0

Description

PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets) to perform information disclosure, denial of service, or request forgery attacks. (PMD 6.x is unaffected because of a 2017-09-15 change.)

Related

Alias · CVE (1)

  • CVE-2019-7722 PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References