dromara/hutool · Security
HuTool XML parsing module has blind XXE vulnerability
- GHSA ID
- GHSA-p2qf-9vp6-3jjq
- CVE ID
- CVE-2023-3276
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference.
CWEs
- CWE-611 · Improper Restriction of XML External Entity Reference