Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pki-caUpgrade idm-pki-serverUpgrade python3-pkiUpgrade idm-pki-baseUpgrade idm-pki-symkeyUpgrade pki-baseUpgrade ldapjdk-javadocUpgrade pki-acmeUpgrade python3-idm-pkiUpgrade idm-pki-base-javaUpgrade idm-pki-acmeUpgrade pki-toolsUpgrade pki-kraUpgrade idm-pki-kraUpgrade pki-base-javaUpgrade idm-pki-caUpgrade idm-pki-toolsUpgrade pki-serverUpgrade pki-symkey | Nov 4, 2022 | Jul 29, 2022 |
| Amazon Linux Ami 2 | — | Upgrade pki-kraUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-core-debuginfoUpgrade pki-toolsUpgrade pki-baseUpgrade pki-symkeyUpgrade pki-caUpgrade pki-javadoc | Apr 21, 2023 | Jul 29, 2022 |
| Centos_linux | — | Upgrade idm-pki-tools-debuginfoUpgrade idm-pki-serverUpgrade pki-symkeyUpgrade jss-debuginfoUpgrade glassfish-jaxb-runtimeUpgrade pki-baseUpgrade pki-core-debuginfoUpgrade pki-kraUpgrade stax-exUpgrade python3-nssUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade jackson-databindUpgrade jss-debugsourceUpgrade xsomUpgrade pki-acmeUpgrade jackson-coreUpgrade xml-commons-resolverUpgrade pki-caUpgrade pki-core-debugsourceUpgrade xml-commons-apisUpgrade jackson-jaxrs-json-providerUpgrade python3-nss-debuginfoUpgrade idm-pki-caUpgrade slf4jUpgrade idm-pki-symkey-debuginfoUpgrade jssUpgrade pki-toolsUpgrade pki-servlet-4.0-apiUpgrade jackson-jaxrs-providersUpgrade python-nss-docUpgrade xmlstreambufferUpgrade idm-pki-baseUpgrade python-nss-debugsourceUpgrade jakarta-commons-httpclientUpgrade velocityUpgrade javassistUpgrade jackson-module-jaxb-annotationsUpgrade idm-pki-kraUpgrade pki-servlet-engineUpgrade glassfish-fastinfosetUpgrade bea-stax-apiUpgrade idm-pki-base-javaUpgrade glassfish-jaxb-txw2Upgrade pki-base-javaUpgrade idm-pki-toolsUpgrade python3-idm-pkiUpgrade apache-commons-netUpgrade pki-serverUpgrade jackson-annotationsUpgrade relaxngDatatypeUpgrade glassfish-jaxb-coreUpgrade javassist-javadocUpgrade idm-pki-symkeyUpgrade glassfish-jaxb-apiUpgrade ldapjdk-javadocUpgrade resteasyUpgrade pki-javadocUpgrade jss-javadocUpgrade xerces-j2Upgrade python3-pkiUpgrade apache-commons-langUpgrade xalan-j2Upgrade ldapjdkUpgrade idm-pki-acmeUpgrade tomcatjss | Nov 3, 2022 | Jul 29, 2022 |
| Debian | — | No solution exists | May 15, 2025 | Jul 29, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-base-javaUpgrade pki-symkeyUpgrade pki-serverUpgrade pki-baseUpgrade pki-caUpgrade pki-toolsUpgrade pki-kra | Jun 9, 2023 | Jul 29, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade pki-symkey | Jun 9, 2023 | Jul 29, 2022 |
| Oracle_linux | — | Upgrade bea-stax-apiUpgrade python-nss-docUpgrade idm-pki-base-javaUpgrade idm-pki-toolsUpgrade jakarta-commons-httpclientUpgrade slf4j-jdk14Upgrade pki-javadocUpgrade idm-pki-symkeyUpgrade jssUpgrade xmlstreambufferUpgrade jackson-jaxrs-providersUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-coreUpgrade xerces-j2Upgrade idm-pki-baseUpgrade xml-commons-resolverUpgrade idm-pki-kraUpgrade python3-nssUpgrade apache-commons-collectionsUpgrade idm-pki-caUpgrade pki-baseUpgrade pki-servlet-engineUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade pki-symkeyUpgrade python3-idm-pkiUpgrade javassistUpgrade stax-exUpgrade idm-pki-acmeUpgrade glassfish-jaxb-runtimeUpgrade ldapjdkUpgrade jackson-databindUpgrade xml-commons-apisUpgrade slf4jUpgrade resteasyUpgrade relaxngDatatypeUpgrade jss-javadocUpgrade jackson-module-jaxb-annotationsUpgrade jackson-coreUpgrade pki-kraUpgrade xsomUpgrade tomcatjssUpgrade pki-caUpgrade xalan-j2Upgrade javassist-javadocUpgrade glassfish-fastinfosetUpgrade idm-pki-serverUpgrade pki-toolsUpgrade pki-base-javaUpgrade jackson-annotationsUpgrade python3-pkiUpgrade pki-acmeUpgrade jackson-jaxrs-json-providerUpgrade apache-commons-netUpgrade apache-commons-langUpgrade pki-servlet-4.0-apiUpgrade pki-serverUpgrade glassfish-jaxb-txw2 | Nov 3, 2022 | Jun 10, 2022 |
| Redhat_linux | — | Upgrade jackson-annotationsUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade python3-pkiUpgrade glassfish-jaxb-coreUpgrade idm-pki-acmeUpgrade idm-pki-symkeyUpgrade resteasyUpgrade ldapjdkUpgrade pki-serverUpgrade ldapjdk-javadocUpgrade idm-pki-toolsUpgrade relaxngDatatypeUpgrade tomcatjssUpgrade apache-commons-netUpgrade pki-base-javaUpgrade pki-servlet-engineUpgrade xalan-j2Upgrade jss-javadocUpgrade jakarta-commons-httpclientUpgrade python3-idm-pkiUpgrade idm-pki-kraUpgrade apache-commons-langUpgrade javassist-javadocUpgrade pki-javadocUpgrade glassfish-jaxb-txw2Upgrade idm-pki-base-javaUpgrade javassistUpgrade pki-symkey-debuginfoUpgrade xerces-j2Upgrade stax-exUpgrade bea-stax-apiUpgrade jackson-module-jaxb-annotationsUpgrade pki-tools-debuginfoUpgrade pki-acmeUpgrade idm-pki-serverUpgrade idm-pki-symkey-debuginfoUpgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade pki-caUpgrade jssUpgrade pki-symkeyUpgrade jackson-jaxrs-providersUpgrade apache-commons-collectionsUpgrade idm-pki-caUpgrade xml-commons-resolverUpgrade pki-baseUpgrade pki-core-debuginfoUpgrade pki-toolsUpgrade xml-commons-apisUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-runtimeNo solution existsUpgrade python-nss-debugsourceUpgrade jss-debugsourceUpgrade xmlstreambufferUpgrade jackson-jaxrs-json-providerUpgrade slf4j-jdk14Upgrade python3-nssUpgrade jackson-databindUpgrade pki-core-debugsourceUpgrade xsomUpgrade slf4jUpgrade jss-debuginfoUpgrade pki-kraUpgrade idm-pki-tools-debuginfoUpgrade jackson-coreUpgrade idm-pki-base | Nov 3, 2022 | Jul 29, 2022 |
| Rocky_linux | — | Upgrade pki-core-debuginfoUpgrade pki-core-debugsourceUpgrade python3-nssUpgrade jss-debugsourceUpgrade jss-debuginfoUpgrade idm-pki-symkeyUpgrade python3-nss-debuginfoUpgrade pki-symkeyUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade idm-pki-toolsUpgrade idm-pki-tools-debuginfoUpgrade jssUpgrade jss-javadocUpgrade idm-pki-symkey-debuginfoUpgrade pki-tools | Mar 12, 2024 | Jul 29, 2022 |
| Ubuntu | — | Upgrade pki-server (Ubuntu Pro)Upgrade pki-base (Ubuntu Pro)Upgrade pki-ca (Ubuntu Pro)Upgrade dogtag-pki (Ubuntu Pro)Upgrade pki-base-java (Ubuntu Pro) | Dec 11, 2024 | Jul 29, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub