GitHub Advisoryadvisory · Maven

GHSA-8c3x-hq82-gjcm XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`

HIGH Published 2025-01-24 Modified 2026-01-28 Official page ↗
Aliases
CVE-2024-52807
Ecosystem
Maven
Packages
org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli, org.hl7.fhir.publisher:org.hl7.fhir.publisher.core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2025-01-24

Affected packages

• Maven org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli: < 1.7.4 → fixed in 1.7.4 • Maven org.hl7.fhir.publisher:org.hl7.fhir.publisher.core: < 1.7.4 → fixed in 1.7.4

Description

Impact XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.publisher is being used to within a host where external clients can submit XML. A previous release provided an incomplete solution revealed by new testing. Patches This issue has been patched as of version 1.7.4 Workarounds None References Previous Advisory for Incomplete solution MITRE CWE OWASP XML External Entity Prevention Cheat Sheet

Related

Alias · CVE (1)

  • CVE-2024-52807 The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References