Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pki-serverUpgrade idm-pki-kraUpgrade idm-pki-acmeUpgrade python3-idm-pkiUpgrade idm-pki-base-javaUpgrade idm-pki-caUpgrade pki-symkeyUpgrade pki-kraUpgrade ldapjdk-javadocUpgrade pki-base-javaUpgrade pki-acmeUpgrade pki-toolsUpgrade idm-pki-toolsUpgrade pki-baseUpgrade idm-pki-serverUpgrade idm-pki-symkeyUpgrade python3-pkiUpgrade idm-pki-baseUpgrade pki-ca | Nov 4, 2022 | Jul 29, 2022 |
| Amazon Linux Ami 2 | — | Upgrade pki-toolsUpgrade pki-caUpgrade pki-core-debuginfoUpgrade pki-javadocUpgrade pki-baseUpgrade pki-symkeyUpgrade pki-base-javaUpgrade pki-serverUpgrade pki-kra | Apr 21, 2023 | Jul 29, 2022 |
| Centos_linux | — | Upgrade pki-base-javaUpgrade apache-commons-netUpgrade idm-pki-toolsUpgrade python3-idm-pkiUpgrade pki-serverUpgrade glassfish-jaxb-apiUpgrade idm-pki-symkeyUpgrade python3-pkiUpgrade javassist-javadocUpgrade xalan-j2Upgrade apache-commons-langUpgrade ldapjdk-javadocUpgrade jakarta-commons-httpclientUpgrade javassistUpgrade jackson-module-jaxb-annotationsUpgrade jackson-annotationsUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-txw2Upgrade idm-pki-kraUpgrade idm-pki-acmeUpgrade relaxngDatatypeUpgrade resteasyUpgrade ldapjdkUpgrade pki-javadocUpgrade bea-stax-apiUpgrade idm-pki-base-javaUpgrade tomcatjssUpgrade velocityUpgrade xerces-j2Upgrade jss-javadocUpgrade glassfish-fastinfosetUpgrade pki-servlet-engineUpgrade python-nss-docUpgrade idm-pki-symkey-debuginfoUpgrade xmlstreambufferUpgrade idm-pki-serverUpgrade pki-servlet-4.0-apiUpgrade idm-pki-tools-debuginfoUpgrade jackson-coreUpgrade jssUpgrade jackson-jaxrs-json-providerUpgrade jackson-databindUpgrade slf4jUpgrade pki-toolsUpgrade xsomUpgrade pki-acmeUpgrade jss-debuginfoUpgrade pki-symkeyUpgrade pki-core-debuginfoUpgrade pki-baseUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade idm-pki-caUpgrade xml-commons-resolverUpgrade xml-commons-apisUpgrade python3-nss-debuginfoUpgrade python3-nssUpgrade stax-exUpgrade python-nss-debugsourceUpgrade pki-kraUpgrade pki-core-debugsourceUpgrade jackson-jaxrs-providersUpgrade jss-debugsourceUpgrade idm-pki-baseUpgrade pki-ca | Nov 3, 2022 | Jul 29, 2022 |
| Debian | — | No solution exists | May 15, 2025 | Jul 29, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-kraUpgrade pki-toolsUpgrade pki-serverUpgrade pki-caUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-base-java | Jun 9, 2023 | Jul 29, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade pki-symkey | Jun 9, 2023 | Jul 29, 2022 |
| Oracle_linux | — | Upgrade idm-pki-caUpgrade xml-commons-resolverUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-runtimeUpgrade jackson-databindUpgrade xerces-j2Upgrade slf4j-jdk14Upgrade ldapjdk-javadocUpgrade ldapjdkUpgrade pki-symkeyUpgrade idm-pki-acmeUpgrade python3-idm-pkiUpgrade stax-exUpgrade idm-pki-base-javaUpgrade pki-baseUpgrade pki-javadocUpgrade pki-servlet-engineUpgrade glassfish-jaxb-apiUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade idm-pki-symkeyUpgrade bea-stax-apiUpgrade python-nss-docUpgrade velocityUpgrade idm-pki-toolsUpgrade idm-pki-baseUpgrade idm-pki-kraUpgrade apache-commons-collectionsUpgrade jackson-jaxrs-providersUpgrade xmlstreambufferUpgrade jssUpgrade python3-nssUpgrade pki-base-javaUpgrade pki-servlet-4.0-apiUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-apisUpgrade resteasyUpgrade relaxngDatatypeUpgrade jss-javadocUpgrade slf4jUpgrade jackson-coreUpgrade glassfish-jaxb-txw2Upgrade pki-serverUpgrade jackson-jaxrs-json-providerUpgrade python3-pkiUpgrade xsomUpgrade idm-pki-serverUpgrade apache-commons-langUpgrade apache-commons-netUpgrade tomcatjssUpgrade pki-caUpgrade javassist-javadocUpgrade xalan-j2Upgrade glassfish-fastinfosetUpgrade pki-acmeUpgrade pki-toolsUpgrade pki-kraUpgrade jackson-annotations | Nov 3, 2022 | Jun 10, 2022 |
| Redhat_linux | — | Upgrade pki-symkey-debuginfoUpgrade jackson-module-jaxb-annotationsUpgrade jackson-annotationsUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-apiUpgrade idm-pki-toolsUpgrade jakarta-commons-httpclientUpgrade idm-pki-base-javaUpgrade ldapjdk-javadocUpgrade velocityUpgrade tomcatjssUpgrade resteasyUpgrade pki-javadocUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade python3-idm-pkiUpgrade ldapjdkUpgrade stax-exUpgrade pki-serverUpgrade xerces-j2Upgrade bea-stax-apiUpgrade idm-pki-kraUpgrade apache-commons-langUpgrade glassfish-jaxb-txw2Upgrade javassist-javadocUpgrade pki-tools-debuginfoUpgrade jss-javadocUpgrade pki-base-javaUpgrade pki-servlet-engineUpgrade idm-pki-acmeUpgrade idm-pki-symkeyUpgrade apache-commons-netUpgrade javassistUpgrade python3-pkiUpgrade glassfish-jaxb-coreUpgrade pki-toolsUpgrade xml-commons-apisUpgrade jss-debuginfoNo solution existsUpgrade jackson-jaxrs-json-providerUpgrade slf4jUpgrade xmlstreambufferUpgrade python3-nssUpgrade xml-commons-resolverUpgrade pki-kraUpgrade slf4j-jdk14Upgrade pki-caUpgrade idm-pki-tools-debuginfoUpgrade python-nss-debugsourceUpgrade idm-pki-baseUpgrade jackson-coreUpgrade idm-pki-caUpgrade python3-nss-debuginfoUpgrade pki-symkeyUpgrade idm-pki-serverUpgrade idm-pki-symkey-debuginfoUpgrade pki-acmeUpgrade pki-baseUpgrade apache-commons-collectionsUpgrade pki-core-debugsourceUpgrade pki-servlet-4.0-apiUpgrade jackson-databindUpgrade python-nss-docUpgrade jssUpgrade jss-debugsourceUpgrade xsomUpgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-providersUpgrade pki-core-debuginfo | Nov 3, 2022 | Jul 29, 2022 |
| Rocky_linux | — | Upgrade idm-pki-symkey-debuginfoUpgrade jss-javadocUpgrade idm-pki-tools-debuginfoUpgrade jssUpgrade pki-toolsUpgrade python-nss-debugsourceUpgrade python3-nss-debuginfoUpgrade jss-debugsourceUpgrade idm-pki-toolsUpgrade python3-nssUpgrade pki-core-debugsourceUpgrade jss-debuginfoUpgrade idm-pki-symkeyUpgrade pki-symkeyUpgrade pki-core-debuginfoUpgrade python-nss-doc | Mar 12, 2024 | Jul 29, 2022 |
| Ubuntu | — | Upgrade dogtag-pki (Ubuntu Pro)Upgrade pki-server (Ubuntu Pro)Upgrade pki-base (Ubuntu Pro)Upgrade pki-ca (Ubuntu Pro)Upgrade pki-base-java (Ubuntu Pro) | Dec 11, 2024 | Jul 29, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub