GitHub Advisoryadvisory · Maven

GHSA-pjch-4g28-fxx7 External Entity Reference in TwelveMonkeys ImageIO

CRITICAL Published 2022-05-07 Modified 2022-05-24 Official page ↗
Aliases
CVE-2021-23792
Ecosystem
Maven
Packages
com.twelvemonkeys.imageio:imageio-metadata
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2022-05-24

Affected packages

• Maven com.twelvemonkeys.imageio:imageio-metadata: < 3.7.1 → fixed in 3.7.1

Description

The package com.twelvemonkeys.imageio:imageio-metadata before version 3.7.1 is vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file (e.g. when an online profile picture is processed) with a malicious XMP segment. If the XMP metadata of the uploaded image is parsed, then the XXE vulnerability is triggered.

Related

Alias · CVE (1)

  • CVE-2021-23792 The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References