GitHub Advisoryadvisory · Maven

GHSA-f5qf-vh69-9q4r SimpleXML has XML External Entity (XXE) vulnerability

CRITICAL Published 2022-05-14 Modified 2025-09-15 Official page ↗
Aliases
CVE-2017-1000190
Ecosystem
Maven
Packages
org.simpleframework:simple-xml
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weaknesses
CWE-611
Reviewed
2022-05-31

Affected packages

• Maven org.simpleframework:simple-xml: < 2.7.1 → fixed in 2.7.1

Description

SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on.

Related

Alias · CVE (1)

  • CVE-2017-1000190 SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References