GitHub Advisoryadvisory · Maven

GHSA-6qx9-rf9g-7jmr Improper Input Validation in Drools and jBPM

HIGH Published 2022-05-17 Modified 2022-07-06 Official page ↗
Aliases
CVE-2014-8125
Ecosystem
Maven
Packages
org.drools:drools-core, org.jbpm:jbpm-bpmn2
Severity
High
Weaknesses
CWE-20
Reviewed
2022-07-06

Affected packages

• Maven org.drools:drools-core: < 6.2.0.Final → fixed in 6.2.0.Final • Maven org.jbpm:jbpm-bpmn2: < 6.2.0.Final → fixed in 6.2.0.Final

Description

XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

Related

Alias · CVE (1)

  • CVE-2014-8125 XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References