GitHub Advisoryadvisory · Maven

GHSA-v62g-jwj9-rfvx XML External Entity Reference (XXE) in the XML Format Plugin in Apache Drill

HIGH Published 2024-07-24 Modified 2024-09-10 Official page ↗
Aliases
CVE-2023-48362
Ecosystem
Maven
Packages
org.apache.drill.exec:drill-java-exec
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2024-07-24

Affected packages

• Maven org.apache.drill.exec:drill-java-exec: >= 1.19.0, < 1.21.2 → fixed in 1.21.2

Description

XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2023-48362 XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References