Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade idm-pki-symkeyUpgrade pki-baseUpgrade python3-pkiUpgrade idm-pki-serverUpgrade pki-caUpgrade idm-pki-baseUpgrade idm-pki-caUpgrade idm-pki-toolsUpgrade ldapjdk-javadocUpgrade idm-pki-base-javaUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-serverUpgrade pki-kraUpgrade idm-pki-acmeUpgrade idm-pki-kraUpgrade pki-base-javaUpgrade pki-acmeUpgrade python3-idm-pki | Nov 4, 2022 | Jul 29, 2022 |
| Amazon Linux Ami 2 | — | Upgrade pki-baseUpgrade pki-javadocUpgrade pki-toolsUpgrade pki-caUpgrade pki-core-debuginfoUpgrade pki-base-javaUpgrade pki-symkeyUpgrade pki-kraUpgrade pki-server | Apr 21, 2023 | Jul 29, 2022 |
| Centos_linux | — | Upgrade jss-debugsourceUpgrade idm-pki-tools-debuginfoUpgrade pki-caUpgrade jss-debuginfoUpgrade pki-acmeUpgrade pki-baseUpgrade pki-core-debuginfoUpgrade pki-symkeyUpgrade xsomUpgrade slf4jUpgrade slf4j-jdk14Upgrade xml-commons-resolverUpgrade apache-commons-collectionsUpgrade jackson-jaxrs-json-providerUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-runtimeUpgrade idm-pki-baseUpgrade jackson-coreUpgrade idm-pki-symkey-debuginfoUpgrade jssUpgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade idm-pki-serverUpgrade idm-pki-caUpgrade xml-commons-apisUpgrade pki-kraUpgrade pki-toolsUpgrade python-nss-debugsourceUpgrade stax-exUpgrade xmlstreambufferUpgrade jackson-databindUpgrade pki-core-debugsourceUpgrade python3-nssUpgrade jackson-jaxrs-providersUpgrade resteasyUpgrade velocityUpgrade tomcatjssUpgrade pki-servlet-engineUpgrade glassfish-fastinfosetUpgrade bea-stax-apiUpgrade python3-pkiUpgrade apache-commons-langUpgrade xalan-j2Upgrade ldapjdkUpgrade idm-pki-acmeUpgrade glassfish-jaxb-apiUpgrade python3-idm-pkiUpgrade apache-commons-netUpgrade pki-serverUpgrade pki-base-javaUpgrade idm-pki-toolsUpgrade javassist-javadocUpgrade ldapjdk-javadocUpgrade idm-pki-symkeyUpgrade jss-javadocUpgrade xerces-j2Upgrade pki-javadocUpgrade jackson-annotationsUpgrade glassfish-jaxb-coreUpgrade relaxngDatatypeUpgrade idm-pki-base-javaUpgrade jakarta-commons-httpclientUpgrade javassistUpgrade jackson-module-jaxb-annotationsUpgrade idm-pki-kraUpgrade glassfish-jaxb-txw2 | Nov 3, 2022 | Jul 29, 2022 |
| Debian | — | No solution exists | May 15, 2025 | Jul 29, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-kraUpgrade pki-toolsUpgrade pki-caUpgrade pki-base-javaUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-server | Jun 9, 2023 | Jul 29, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade pki-symkey | Jun 9, 2023 | Jul 29, 2022 |
| Oracle_linux | — | Upgrade pki-caUpgrade glassfish-fastinfosetUpgrade pki-kraUpgrade apache-commons-netUpgrade javassist-javadocUpgrade pki-acmeUpgrade pki-serverUpgrade jackson-annotationsUpgrade pki-base-javaUpgrade tomcatjssUpgrade xsomUpgrade jackson-jaxrs-json-providerUpgrade pki-toolsUpgrade pki-servlet-4.0-apiUpgrade idm-pki-serverUpgrade xalan-j2Upgrade relaxngDatatypeUpgrade resteasyUpgrade slf4jUpgrade apache-commons-langUpgrade python3-pkiUpgrade xml-commons-apisUpgrade jss-javadocUpgrade jackson-coreUpgrade glassfish-jaxb-txw2Upgrade jackson-module-jaxb-annotationsUpgrade bea-stax-apiUpgrade xmlstreambufferUpgrade velocityUpgrade python-nss-docUpgrade pki-servlet-engineUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-coreUpgrade idm-pki-caUpgrade jssUpgrade idm-pki-acmeUpgrade stax-exUpgrade ldapjdk-javadocUpgrade xerces-j2Upgrade slf4j-jdk14Upgrade xml-commons-resolverUpgrade python3-nssUpgrade idm-pki-toolsUpgrade idm-pki-kraUpgrade idm-pki-baseUpgrade apache-commons-collectionsUpgrade python3-idm-pkiUpgrade jackson-jaxrs-providersUpgrade idm-pki-symkeyUpgrade idm-pki-base-javaUpgrade pki-symkeyUpgrade jackson-databindUpgrade ldapjdkUpgrade pki-baseUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-apiUpgrade pki-javadoc | Nov 3, 2022 | Jun 10, 2022 |
| Redhat_linux | — | Upgrade idm-pki-acmeUpgrade glassfish-jaxb-coreUpgrade javassist-javadocUpgrade idm-pki-symkeyUpgrade jss-javadocUpgrade relaxngDatatypeUpgrade glassfish-fastinfosetUpgrade pki-tools-debuginfoUpgrade xalan-j2Upgrade apache-commons-netUpgrade pki-symkey-debuginfoUpgrade jackson-module-jaxb-annotationsUpgrade idm-pki-toolsUpgrade stax-exUpgrade resteasyUpgrade bea-stax-apiUpgrade pki-servlet-engineUpgrade velocityUpgrade python3-pkiUpgrade pki-base-javaUpgrade xerces-j2Upgrade jakarta-commons-httpclientUpgrade javassistUpgrade python3-idm-pkiUpgrade apache-commons-langUpgrade glassfish-jaxb-txw2Upgrade jackson-annotationsUpgrade idm-pki-kraUpgrade glassfish-jaxb-apiUpgrade pki-javadocUpgrade pki-serverUpgrade ldapjdkUpgrade idm-pki-base-javaUpgrade tomcatjssUpgrade ldapjdk-javadocUpgrade xml-commons-resolverUpgrade slf4jUpgrade python3-nss-debuginfoUpgrade pki-acmeUpgrade idm-pki-tools-debuginfoNo solution existsUpgrade idm-pki-symkey-debuginfoUpgrade jackson-databindUpgrade jackson-jaxrs-providersUpgrade pki-core-debuginfoUpgrade pki-toolsUpgrade apache-commons-collectionsUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-runtimeUpgrade jss-debuginfoUpgrade xsomUpgrade pki-kraUpgrade jackson-coreUpgrade xml-commons-apisUpgrade pki-core-debugsourceUpgrade idm-pki-baseUpgrade pki-caUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade jss-debugsourceUpgrade slf4j-jdk14Upgrade pki-baseUpgrade python3-nssUpgrade xmlstreambufferUpgrade jssUpgrade idm-pki-serverUpgrade jackson-jaxrs-json-providerUpgrade pki-symkeyUpgrade idm-pki-ca | Nov 3, 2022 | Jul 29, 2022 |
| Rocky_linux | — | Upgrade jssUpgrade jss-javadocUpgrade pki-toolsUpgrade idm-pki-tools-debuginfoUpgrade idm-pki-symkey-debuginfoUpgrade jss-debuginfoUpgrade python-nss-debugsourceUpgrade pki-symkeyUpgrade python-nss-docUpgrade idm-pki-symkeyUpgrade pki-core-debuginfoUpgrade jss-debugsourceUpgrade pki-core-debugsourceUpgrade python3-nssUpgrade python3-nss-debuginfoUpgrade idm-pki-tools | Mar 12, 2024 | Jul 29, 2022 |
| Ubuntu | — | Upgrade dogtag-pki (Ubuntu Pro)Upgrade pki-base (Ubuntu Pro)Upgrade pki-ca (Ubuntu Pro)Upgrade pki-server (Ubuntu Pro)Upgrade pki-base-java (Ubuntu Pro) | Dec 11, 2024 | Jul 29, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub