GitStock

hunterhacker/jdom · Security

XML External Entity (XXE) Injection in JDOM

GHSA ID
GHSA-2363-cqg2-863c
CVE ID
CVE-2021-33813
Severity
high
Published
Updated
CVSS
7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v3
7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. As a workaround, to avoid external entities being expanded, one can call builder.setExpandEntities(false) and they won't be expanded.

CWEs

  • CWE-611 · Improper Restriction of XML External Entity Reference

References