Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pki-toolsUpgrade idm-pki-acmeUpgrade idm-pki-kraUpgrade pki-serverUpgrade pki-acmeUpgrade pki-base-javaUpgrade ldapjdk-javadocUpgrade pki-kraUpgrade idm-pki-toolsUpgrade idm-pki-caUpgrade idm-pki-base-javaUpgrade pki-symkeyUpgrade python3-idm-pkiUpgrade pki-caUpgrade idm-pki-symkeyUpgrade python3-pkiUpgrade idm-pki-serverUpgrade idm-pki-baseUpgrade pki-base | Nov 4, 2022 | Jul 29, 2022 |
| Amazon Linux Ami 2 | — | Upgrade pki-serverUpgrade pki-kraUpgrade pki-toolsUpgrade pki-core-debuginfoUpgrade pki-caUpgrade pki-javadocUpgrade pki-base-javaUpgrade pki-symkeyUpgrade pki-base | Apr 21, 2023 | Jul 29, 2022 |
| Centos_linux | — | Upgrade jackson-coreUpgrade xml-commons-resolverUpgrade jssUpgrade idm-pki-caUpgrade pki-symkeyUpgrade xml-commons-apisUpgrade jackson-jaxrs-json-providerUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-runtimeUpgrade slf4j-jdk14Upgrade pki-baseUpgrade pki-core-debuginfoUpgrade python3-nssUpgrade stax-exUpgrade python-nss-debugsourceUpgrade jackson-jaxrs-providersUpgrade idm-pki-baseUpgrade python3-nss-debuginfoUpgrade pki-toolsUpgrade pki-core-debugsourceUpgrade python-nss-docUpgrade idm-pki-serverUpgrade pki-caUpgrade jss-debuginfoUpgrade xmlstreambufferUpgrade pki-acmeUpgrade idm-pki-tools-debuginfoUpgrade pki-kraUpgrade jackson-databindUpgrade jss-debugsourceUpgrade xsomUpgrade pki-servlet-4.0-apiUpgrade idm-pki-symkey-debuginfoUpgrade slf4jUpgrade glassfish-jaxb-coreUpgrade javassistUpgrade idm-pki-symkeyUpgrade python3-idm-pkiUpgrade apache-commons-netUpgrade pki-serverUpgrade pki-base-javaUpgrade idm-pki-toolsUpgrade relaxngDatatypeUpgrade jackson-annotationsUpgrade resteasyUpgrade idm-pki-kraUpgrade glassfish-jaxb-txw2Upgrade jackson-module-jaxb-annotationsUpgrade velocityUpgrade tomcatjssUpgrade pki-servlet-engineUpgrade glassfish-fastinfosetUpgrade bea-stax-apiUpgrade jakarta-commons-httpclientUpgrade idm-pki-base-javaUpgrade glassfish-jaxb-apiUpgrade javassist-javadocUpgrade pki-javadocUpgrade jss-javadocUpgrade xerces-j2Upgrade python3-pkiUpgrade apache-commons-langUpgrade xalan-j2Upgrade ldapjdkUpgrade idm-pki-acmeUpgrade ldapjdk-javadoc | Nov 3, 2022 | Jul 29, 2022 |
| Debian | — | No solution exists | May 15, 2025 | Jul 29, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-toolsUpgrade pki-kraUpgrade pki-caUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-symkeyUpgrade pki-server | Jun 9, 2023 | Jul 29, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade pki-symkey | Jun 9, 2023 | Jul 29, 2022 |
| Oracle_linux | — | Upgrade glassfish-jaxb-coreUpgrade idm-pki-base-javaUpgrade glassfish-jaxb-runtimeUpgrade jackson-databindUpgrade pki-symkeyUpgrade python3-idm-pkiUpgrade jackson-jaxrs-providersUpgrade ldapjdkUpgrade ldapjdk-javadocUpgrade idm-pki-acmeUpgrade stax-exUpgrade idm-pki-symkeyUpgrade jssUpgrade idm-pki-baseUpgrade bea-stax-apiUpgrade javassistUpgrade pki-baseUpgrade python-nss-docUpgrade pki-servlet-engineUpgrade idm-pki-caUpgrade xmlstreambufferUpgrade idm-pki-kraUpgrade python3-nssUpgrade pki-javadocUpgrade velocityUpgrade apache-commons-collectionsUpgrade idm-pki-toolsUpgrade glassfish-jaxb-apiUpgrade jakarta-commons-httpclientUpgrade slf4j-jdk14Upgrade xerces-j2Upgrade xml-commons-resolverUpgrade idm-pki-serverUpgrade pki-servlet-4.0-apiUpgrade xsomUpgrade tomcatjssUpgrade jackson-coreUpgrade glassfish-jaxb-txw2Upgrade slf4jUpgrade relaxngDatatypeUpgrade resteasyUpgrade xml-commons-apisUpgrade glassfish-fastinfosetUpgrade jss-javadocUpgrade pki-toolsUpgrade jackson-annotationsUpgrade pki-kraUpgrade pki-base-javaUpgrade xalan-j2Upgrade javassist-javadocUpgrade python3-pkiUpgrade pki-caUpgrade jackson-module-jaxb-annotationsUpgrade pki-serverUpgrade pki-acmeUpgrade jackson-jaxrs-json-providerUpgrade apache-commons-netUpgrade apache-commons-lang | Nov 3, 2022 | Jun 10, 2022 |
| Redhat_linux | — | Upgrade idm-pki-baseUpgrade jackson-coreUpgrade pki-toolsUpgrade pki-caUpgrade xml-commons-apisUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade idm-pki-tools-debuginfoUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade xsomUpgrade slf4jUpgrade jackson-databindUpgrade idm-pki-caUpgrade idm-pki-serverUpgrade python-nss-docUpgrade jssUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-runtimeUpgrade pki-core-debugsourceUpgrade pki-symkeyUpgrade pki-kraUpgrade jss-debuginfoUpgrade idm-pki-symkey-debuginfoNo solution existsUpgrade pki-acmeUpgrade xml-commons-resolverUpgrade pki-servlet-4.0-apiUpgrade pki-core-debuginfoUpgrade pki-baseUpgrade python3-nssUpgrade jss-debugsourceUpgrade glassfish-jaxb-apiUpgrade python3-pkiUpgrade ldapjdkUpgrade pki-javadocUpgrade glassfish-jaxb-txw2Upgrade velocityUpgrade glassfish-fastinfosetUpgrade jakarta-commons-httpclientUpgrade ldapjdk-javadocUpgrade apache-commons-langUpgrade idm-pki-base-javaUpgrade tomcatjssUpgrade pki-serverUpgrade pki-base-javaUpgrade idm-pki-symkeyUpgrade pki-symkey-debuginfoUpgrade bea-stax-apiUpgrade apache-commons-netUpgrade xerces-j2Upgrade stax-exUpgrade javassist-javadocUpgrade jss-javadocUpgrade xalan-j2Upgrade jackson-annotationsUpgrade idm-pki-acmeUpgrade idm-pki-toolsUpgrade pki-servlet-engineUpgrade pki-tools-debuginfoUpgrade relaxngDatatypeUpgrade jackson-module-jaxb-annotationsUpgrade resteasyUpgrade javassistUpgrade idm-pki-kraUpgrade glassfish-jaxb-coreUpgrade python3-idm-pki | Nov 3, 2022 | Jul 29, 2022 |
| Rocky_linux | — | Upgrade pki-core-debuginfoUpgrade idm-pki-symkeyUpgrade jss-debuginfoUpgrade python3-nss-debuginfoUpgrade jss-debugsourceUpgrade pki-symkeyUpgrade python-nss-debugsourceUpgrade python3-nssUpgrade idm-pki-toolsUpgrade pki-core-debugsourceUpgrade python-nss-docUpgrade idm-pki-symkey-debuginfoUpgrade jss-javadocUpgrade idm-pki-tools-debuginfoUpgrade jssUpgrade pki-tools | Mar 12, 2024 | Jul 29, 2022 |
| Ubuntu | — | Upgrade pki-base-java (Ubuntu Pro)Upgrade pki-ca (Ubuntu Pro)Upgrade dogtag-pki (Ubuntu Pro)Upgrade pki-base (Ubuntu Pro)Upgrade pki-server (Ubuntu Pro) | Dec 11, 2024 | Jul 29, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub