Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pki-symkeyUpgrade pki-toolsUpgrade idm-pki-kraUpgrade idm-pki-caUpgrade idm-pki-base-javaUpgrade pki-kraUpgrade idm-pki-acmeUpgrade pki-serverUpgrade python3-idm-pkiUpgrade pki-acmeUpgrade ldapjdk-javadocUpgrade pki-base-javaUpgrade idm-pki-toolsUpgrade idm-pki-serverUpgrade pki-caUpgrade python3-pkiUpgrade pki-baseUpgrade idm-pki-symkeyUpgrade idm-pki-base | Nov 4, 2022 | Jul 29, 2022 |
| Amazon Linux Ami 2 | — | Upgrade pki-serverUpgrade pki-kraUpgrade pki-core-debuginfoUpgrade pki-symkeyUpgrade pki-base-javaUpgrade pki-javadocUpgrade pki-baseUpgrade pki-toolsUpgrade pki-ca | Apr 21, 2023 | Jul 29, 2022 |
| Centos_linux | — | Upgrade pki-base-javaUpgrade pki-serverUpgrade idm-pki-toolsUpgrade apache-commons-netUpgrade jss-javadocUpgrade pki-javadocUpgrade javassistUpgrade python3-idm-pkiUpgrade xerces-j2Upgrade glassfish-jaxb-coreUpgrade jackson-annotationsUpgrade jakarta-commons-httpclientUpgrade relaxngDatatypeUpgrade velocityUpgrade bea-stax-apiUpgrade idm-pki-base-javaUpgrade tomcatjssUpgrade resteasyUpgrade glassfish-jaxb-txw2Upgrade python3-pkiUpgrade idm-pki-kraUpgrade xalan-j2Upgrade idm-pki-acmeUpgrade jackson-module-jaxb-annotationsUpgrade ldapjdk-javadocUpgrade glassfish-fastinfosetUpgrade pki-servlet-engineUpgrade apache-commons-langUpgrade ldapjdkUpgrade glassfish-jaxb-apiUpgrade idm-pki-symkeyUpgrade javassist-javadocUpgrade pki-toolsUpgrade pki-kraUpgrade idm-pki-symkey-debuginfoUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade python-nss-debugsourceUpgrade idm-pki-caUpgrade jackson-coreUpgrade jssUpgrade jackson-jaxrs-json-providerUpgrade idm-pki-baseUpgrade xsomUpgrade pki-acmeUpgrade jss-debugsourceUpgrade jackson-databindUpgrade pki-caUpgrade xml-commons-apisUpgrade python3-nss-debuginfoUpgrade xmlstreambufferUpgrade python-nss-docUpgrade pki-servlet-4.0-apiUpgrade pki-symkeyUpgrade pki-core-debuginfoUpgrade pki-baseUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade slf4jUpgrade idm-pki-serverUpgrade jss-debuginfoUpgrade idm-pki-tools-debuginfoUpgrade xml-commons-resolverUpgrade pki-core-debugsourceUpgrade python3-nss | Nov 3, 2022 | Jul 29, 2022 |
| Debian | — | No solution exists | May 15, 2025 | Jul 29, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-caUpgrade pki-symkeyUpgrade pki-serverUpgrade pki-baseUpgrade pki-base-javaUpgrade pki-kraUpgrade pki-tools | Jun 9, 2023 | Jul 29, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade pki-symkey | Jun 9, 2023 | Jul 29, 2022 |
| Oracle_linux | — | Upgrade pki-baseUpgrade pki-servlet-engineUpgrade idm-pki-symkeyUpgrade idm-pki-acmeUpgrade pki-symkeyUpgrade jackson-jaxrs-providersUpgrade ldapjdk-javadocUpgrade stax-exUpgrade python3-idm-pkiUpgrade idm-pki-base-javaUpgrade ldapjdkUpgrade glassfish-jaxb-apiUpgrade pki-javadocUpgrade jakarta-commons-httpclientUpgrade velocityUpgrade javassistUpgrade python-nss-docUpgrade xmlstreambufferUpgrade glassfish-jaxb-coreUpgrade jssUpgrade apache-commons-collectionsUpgrade idm-pki-baseUpgrade xerces-j2Upgrade xml-commons-resolverUpgrade bea-stax-apiUpgrade idm-pki-caUpgrade idm-pki-kraUpgrade python3-nssUpgrade slf4j-jdk14Upgrade idm-pki-toolsUpgrade jackson-databindUpgrade glassfish-jaxb-runtimeUpgrade pki-toolsUpgrade apache-commons-netUpgrade apache-commons-langUpgrade jackson-annotationsUpgrade pki-base-javaUpgrade pki-servlet-4.0-apiUpgrade pki-serverUpgrade pki-acmeUpgrade jackson-jaxrs-json-providerUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-txw2Upgrade slf4jUpgrade resteasyUpgrade relaxngDatatypeUpgrade jss-javadocUpgrade xml-commons-apisUpgrade jackson-coreUpgrade jackson-module-jaxb-annotationsUpgrade xalan-j2Upgrade javassist-javadocUpgrade tomcatjssUpgrade pki-caUpgrade xsomUpgrade idm-pki-serverUpgrade python3-pkiUpgrade pki-kra | Nov 3, 2022 | Jun 10, 2022 |
| Redhat_linux | — | Upgrade pki-base-javaUpgrade bea-stax-apiUpgrade idm-pki-symkeyUpgrade pki-tools-debuginfoUpgrade pki-servlet-engineUpgrade idm-pki-toolsUpgrade pki-serverUpgrade ldapjdkUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade glassfish-fastinfosetUpgrade jackson-annotationsUpgrade javassistUpgrade resteasyUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-apiUpgrade python3-pkiUpgrade jackson-module-jaxb-annotationsUpgrade tomcatjssUpgrade javassist-javadocUpgrade pki-javadocUpgrade jss-javadocUpgrade xalan-j2Upgrade idm-pki-base-javaUpgrade velocityUpgrade stax-exUpgrade xerces-j2Upgrade relaxngDatatypeUpgrade apache-commons-netUpgrade apache-commons-langUpgrade jakarta-commons-httpclientUpgrade python3-idm-pkiUpgrade idm-pki-kraUpgrade pki-symkey-debuginfoUpgrade idm-pki-acmeUpgrade jss-debugsourceUpgrade pki-core-debuginfoUpgrade idm-pki-tools-debuginfoUpgrade python3-nssUpgrade slf4jUpgrade jackson-databindUpgrade python-nss-docUpgrade slf4j-jdk14Upgrade pki-baseUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade pki-acmeUpgrade pki-symkeyUpgrade python3-nss-debuginfoUpgrade idm-pki-serverUpgrade jssUpgrade xsomUpgrade pki-servlet-4.0-apiUpgrade xml-commons-resolverUpgrade pki-toolsUpgrade pki-core-debugsourceUpgrade glassfish-jaxb-runtimeNo solution existsUpgrade xml-commons-apisUpgrade jss-debuginfoUpgrade jackson-jaxrs-providersUpgrade pki-kraUpgrade apache-commons-collectionsUpgrade idm-pki-symkey-debuginfoUpgrade idm-pki-caUpgrade python-nss-debugsourceUpgrade idm-pki-baseUpgrade pki-caUpgrade jackson-core | Nov 3, 2022 | Jul 29, 2022 |
| Rocky_linux | — | Upgrade pki-symkeyUpgrade python3-nss-debuginfoUpgrade python3-nssUpgrade jss-debuginfoUpgrade python-nss-docUpgrade pki-core-debugsourceUpgrade python-nss-debugsourceUpgrade jss-debugsourceUpgrade idm-pki-symkeyUpgrade pki-core-debuginfoUpgrade idm-pki-toolsUpgrade idm-pki-tools-debuginfoUpgrade jssUpgrade pki-toolsUpgrade jss-javadocUpgrade idm-pki-symkey-debuginfo | Mar 12, 2024 | Jul 29, 2022 |
| Ubuntu | — | Upgrade pki-base (Ubuntu Pro)Upgrade dogtag-pki (Ubuntu Pro)Upgrade pki-server (Ubuntu Pro)Upgrade pki-ca (Ubuntu Pro)Upgrade pki-base-java (Ubuntu Pro) | Dec 11, 2024 | Jul 29, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub