unstructured-io/unstructured · Security
unstructured XML External Entity (XXE)
- GHSA ID
- GHSA-32r8-54hf-c9p3
- CVE ID
- CVE-2024-46455
- Severity
- medium
- Published
- Updated
- CVSS v4
- 6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Description
unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.
CWEs
- CWE-611 · Improper Restriction of XML External Entity Reference
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-46455 ↗
- https://binarysouljour.me/cve-2024-46455 ↗
- https://github.com/Unstructured-IO/unstructured/pull/3088 ↗
- https://github.com/Unstructured-IO/unstructured/commit/171b5df09fc3346aba8ce91c04de5b3e094a86bd ↗
- https://www.tenable.com/cve/CVE-2024-46455 ↗
- https://github.com/advisories/GHSA-32r8-54hf-c9p3 ↗