GitHub Advisoryadvisory · Maven

GHSA-p2qf-9vp6-3jjq HuTool XML parsing module has blind XXE vulnerability

HIGH Published 2023-06-15 Modified 2024-03-01 Official page ↗
Aliases
CVE-2023-3276
Ecosystem
Maven
Packages
cn.hutool:hutool-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2023-06-16

Affected packages

• Maven cn.hutool:hutool-core: <= 5.8.19 (no fix yet)

Description

A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference.

Related

Alias · CVE (1)

  • CVE-2023-3276 A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References