Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pki-baseUpgrade idm-pki-baseUpgrade pki-caUpgrade python3-pkiUpgrade idm-pki-symkeyUpgrade idm-pki-serverUpgrade idm-pki-caUpgrade pki-kraUpgrade idm-pki-kraUpgrade pki-serverUpgrade idm-pki-base-javaUpgrade python3-idm-pkiUpgrade pki-symkeyUpgrade pki-acmeUpgrade pki-base-javaUpgrade idm-pki-acmeUpgrade ldapjdk-javadocUpgrade idm-pki-toolsUpgrade pki-tools | Nov 4, 2022 | Jul 29, 2022 |
| Amazon Linux Ami 2 | — | Upgrade pki-serverUpgrade pki-kraUpgrade pki-caUpgrade pki-baseUpgrade pki-toolsUpgrade pki-javadocUpgrade pki-core-debuginfoUpgrade pki-symkeyUpgrade pki-base-java | Apr 21, 2023 | Jul 29, 2022 |
| Centos_linux | — | Upgrade python-nss-debugsourceUpgrade python3-nssUpgrade pki-toolsUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade pki-core-debugsourceUpgrade pki-kraUpgrade jss-debugsourceUpgrade pki-acmeUpgrade jackson-databindUpgrade pki-caUpgrade xsomUpgrade xml-commons-resolverUpgrade idm-pki-caUpgrade slf4jUpgrade idm-pki-tools-debuginfoUpgrade python3-nss-debuginfoUpgrade xmlstreambufferUpgrade pki-servlet-4.0-apiUpgrade jss-debuginfoUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-apisUpgrade jackson-coreUpgrade python-nss-docUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-runtimeUpgrade idm-pki-symkey-debuginfoUpgrade idm-pki-serverUpgrade jssUpgrade slf4j-jdk14Upgrade pki-baseUpgrade pki-core-debuginfoUpgrade pki-symkeyUpgrade idm-pki-baseUpgrade idm-pki-kraUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade idm-pki-symkeyUpgrade glassfish-jaxb-apiUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-coreUpgrade relaxngDatatypeUpgrade glassfish-jaxb-txw2Upgrade velocityUpgrade idm-pki-toolsUpgrade python3-idm-pkiUpgrade apache-commons-netUpgrade pki-serverUpgrade pki-base-javaUpgrade idm-pki-base-javaUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade pki-javadocUpgrade jss-javadocUpgrade xerces-j2Upgrade pki-servlet-engineUpgrade resteasyUpgrade bea-stax-apiUpgrade glassfish-fastinfosetUpgrade tomcatjssUpgrade apache-commons-langUpgrade xalan-j2Upgrade idm-pki-acmeUpgrade python3-pkiUpgrade ldapjdkUpgrade javassist-javadoc | Nov 3, 2022 | Jul 29, 2022 |
| Debian | — | No solution exists | May 15, 2025 | Jul 29, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-symkeyUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-caUpgrade pki-kraUpgrade pki-tools | Jun 9, 2023 | Jul 29, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade pki-symkey | Jun 9, 2023 | Jul 29, 2022 |
| Oracle_linux | — | Upgrade javassistUpgrade ldapjdk-javadocUpgrade python-nss-docUpgrade idm-pki-acmeUpgrade python3-nssUpgrade pki-baseUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-engineUpgrade glassfish-jaxb-apiUpgrade idm-pki-baseUpgrade idm-pki-toolsUpgrade jssUpgrade jakarta-commons-httpclientUpgrade xerces-j2Upgrade pki-javadocUpgrade velocityUpgrade bea-stax-apiUpgrade xmlstreambufferUpgrade stax-exUpgrade idm-pki-symkeyUpgrade jackson-jaxrs-providersUpgrade pki-symkeyUpgrade xml-commons-resolverUpgrade slf4j-jdk14Upgrade ldapjdkUpgrade idm-pki-base-javaUpgrade python3-idm-pkiUpgrade apache-commons-collectionsUpgrade jackson-databindUpgrade idm-pki-kraUpgrade glassfish-jaxb-coreUpgrade idm-pki-caUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade apache-commons-netUpgrade slf4jUpgrade pki-kraUpgrade pki-toolsUpgrade pki-base-javaUpgrade pki-servlet-4.0-apiUpgrade pki-acmeUpgrade jackson-jaxrs-json-providerUpgrade tomcatjssUpgrade xalan-j2Upgrade pki-caUpgrade javassist-javadocUpgrade pki-serverUpgrade xsomUpgrade python3-pkiUpgrade idm-pki-serverUpgrade jackson-coreUpgrade glassfish-jaxb-txw2Upgrade xml-commons-apisUpgrade resteasyUpgrade relaxngDatatypeUpgrade jss-javadocUpgrade jackson-annotationsUpgrade glassfish-fastinfoset | Nov 3, 2022 | Jun 10, 2022 |
| Redhat_linux | — | Upgrade idm-pki-base-javaUpgrade pki-symkey-debuginfoUpgrade bea-stax-apiUpgrade apache-commons-netUpgrade pki-base-javaUpgrade idm-pki-symkeyUpgrade idm-pki-acmeUpgrade tomcatjssUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-coreUpgrade javassistUpgrade velocityUpgrade pki-servlet-engineUpgrade pki-tools-debuginfoUpgrade jackson-module-jaxb-annotationsUpgrade ldapjdkUpgrade jss-javadocUpgrade xalan-j2Upgrade pki-javadocUpgrade javassist-javadocUpgrade idm-pki-toolsUpgrade pki-serverUpgrade ldapjdk-javadocUpgrade apache-commons-langUpgrade jakarta-commons-httpclientUpgrade python3-idm-pkiUpgrade idm-pki-kraUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-txw2Upgrade xerces-j2Upgrade stax-exUpgrade python3-pkiUpgrade relaxngDatatypeUpgrade resteasyUpgrade jackson-annotationsUpgrade xsomUpgrade glassfish-jaxb-runtimeUpgrade pki-toolsUpgrade pki-core-debugsourceUpgrade xml-commons-apisUpgrade jackson-databindUpgrade slf4jNo solution existsUpgrade xmlstreambufferUpgrade pki-baseUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade jss-debugsourceUpgrade python3-nssUpgrade idm-pki-symkey-debuginfoUpgrade apache-commons-collectionsUpgrade pki-acmeUpgrade pki-caUpgrade jackson-coreUpgrade idm-pki-baseUpgrade idm-pki-tools-debuginfoUpgrade python3-nss-debuginfoUpgrade jssUpgrade xml-commons-resolverUpgrade pki-kraUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade pki-core-debuginfoUpgrade idm-pki-caUpgrade jackson-jaxrs-json-providerUpgrade idm-pki-serverUpgrade pki-symkeyUpgrade pki-servlet-4.0-apiUpgrade jss-debuginfo | Nov 3, 2022 | Jul 29, 2022 |
| Rocky_linux | — | Upgrade jssUpgrade idm-pki-symkey-debuginfoUpgrade pki-toolsUpgrade jss-javadocUpgrade idm-pki-tools-debuginfoUpgrade jss-debugsourceUpgrade idm-pki-symkeyUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade pki-symkeyUpgrade jss-debuginfoUpgrade python3-nss-debuginfoUpgrade idm-pki-toolsUpgrade python3-nssUpgrade pki-core-debugsourceUpgrade pki-core-debuginfo | Mar 12, 2024 | Jul 29, 2022 |
| Ubuntu | — | Upgrade pki-ca (Ubuntu Pro)Upgrade pki-server (Ubuntu Pro)Upgrade dogtag-pki (Ubuntu Pro)Upgrade pki-base (Ubuntu Pro)Upgrade pki-base-java (Ubuntu Pro) | Dec 11, 2024 | Jul 29, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub