Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pki-baseUpgrade idm-pki-baseUpgrade idm-pki-serverUpgrade idm-pki-symkeyUpgrade pki-caUpgrade python3-pkiUpgrade pki-toolsUpgrade idm-pki-kraUpgrade pki-base-javaUpgrade ldapjdk-javadocUpgrade idm-pki-toolsUpgrade idm-pki-acmeUpgrade pki-kraUpgrade idm-pki-base-javaUpgrade pki-symkeyUpgrade idm-pki-caUpgrade pki-serverUpgrade pki-acmeUpgrade python3-idm-pki | Nov 4, 2022 | Jul 29, 2022 |
| Amazon Linux Ami 2 | — | Upgrade pki-serverUpgrade pki-kraUpgrade pki-toolsUpgrade pki-baseUpgrade pki-symkeyUpgrade pki-core-debuginfoUpgrade pki-caUpgrade pki-base-javaUpgrade pki-javadoc | Apr 21, 2023 | Jul 29, 2022 |
| Centos_linux | — | Upgrade jackson-annotationsUpgrade glassfish-jaxb-coreUpgrade idm-pki-base-javaUpgrade jakarta-commons-httpclientUpgrade relaxngDatatypeUpgrade idm-pki-acmeUpgrade ldapjdkUpgrade apache-commons-langUpgrade xalan-j2Upgrade ldapjdk-javadocUpgrade glassfish-jaxb-apiUpgrade javassistUpgrade apache-commons-netUpgrade pki-base-javaUpgrade pki-javadocUpgrade jackson-module-jaxb-annotationsUpgrade python3-idm-pkiUpgrade idm-pki-symkeyUpgrade glassfish-jaxb-txw2Upgrade resteasyUpgrade idm-pki-toolsUpgrade pki-serverUpgrade idm-pki-kraUpgrade python3-pkiUpgrade javassist-javadocUpgrade xerces-j2Upgrade glassfish-fastinfosetUpgrade bea-stax-apiUpgrade pki-servlet-engineUpgrade tomcatjssUpgrade velocityUpgrade jss-javadocUpgrade jss-debuginfoUpgrade idm-pki-symkey-debuginfoUpgrade idm-pki-tools-debuginfoUpgrade pki-toolsUpgrade pki-core-debugsourceUpgrade stax-exUpgrade xml-commons-apisUpgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade xmlstreambufferUpgrade slf4j-jdk14Upgrade pki-core-debuginfoUpgrade pki-baseUpgrade slf4jUpgrade apache-commons-collectionsUpgrade pki-symkeyUpgrade glassfish-jaxb-runtimeUpgrade jssUpgrade jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade idm-pki-serverUpgrade python-nss-debugsourceUpgrade pki-kraUpgrade python3-nssUpgrade jackson-jaxrs-providersUpgrade pki-servlet-4.0-apiUpgrade xsomUpgrade pki-caUpgrade pki-acmeUpgrade jss-debugsourceUpgrade jackson-databindUpgrade idm-pki-baseUpgrade idm-pki-caUpgrade xml-commons-resolver | Nov 3, 2022 | Jul 29, 2022 |
| Debian | — | No solution exists | May 15, 2025 | Jul 29, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-base-javaUpgrade pki-caUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-serverUpgrade pki-toolsUpgrade pki-kra | Jun 9, 2023 | Jul 29, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade pki-symkey | Jun 9, 2023 | Jul 29, 2022 |
| Oracle_linux | — | Upgrade ldapjdkUpgrade idm-pki-acmeUpgrade idm-pki-toolsUpgrade pki-symkeyUpgrade python3-idm-pkiUpgrade apache-commons-collectionsUpgrade stax-exUpgrade idm-pki-baseUpgrade idm-pki-kraUpgrade python3-nssUpgrade jackson-databindUpgrade idm-pki-symkeyUpgrade glassfish-jaxb-runtimeUpgrade idm-pki-base-javaUpgrade jakarta-commons-httpclientUpgrade javassistUpgrade jssUpgrade bea-stax-apiUpgrade idm-pki-caUpgrade xmlstreambufferUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-apiUpgrade pki-servlet-engineUpgrade xml-commons-resolverUpgrade velocityUpgrade slf4j-jdk14Upgrade xerces-j2Upgrade ldapjdk-javadocUpgrade python-nss-docUpgrade pki-baseUpgrade pki-javadocUpgrade xalan-j2Upgrade python3-pkiUpgrade jackson-jaxrs-json-providerUpgrade apache-commons-netUpgrade apache-commons-langUpgrade xsomUpgrade pki-serverUpgrade pki-acmeUpgrade pki-servlet-4.0-apiUpgrade glassfish-fastinfosetUpgrade pki-base-javaUpgrade tomcatjssUpgrade pki-caUpgrade glassfish-jaxb-txw2Upgrade xml-commons-apisUpgrade resteasyUpgrade relaxngDatatypeUpgrade jackson-module-jaxb-annotationsUpgrade slf4jUpgrade jackson-coreUpgrade jss-javadocUpgrade idm-pki-serverUpgrade pki-toolsUpgrade pki-kraUpgrade jackson-annotationsUpgrade javassist-javadoc | Nov 3, 2022 | Jun 10, 2022 |
| Redhat_linux | — | Upgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade jakarta-commons-httpclientUpgrade jss-javadocUpgrade idm-pki-kraUpgrade pki-servlet-engineUpgrade idm-pki-toolsUpgrade javassist-javadocUpgrade idm-pki-acmeUpgrade pki-tools-debuginfoUpgrade xerces-j2Upgrade pki-serverUpgrade stax-exUpgrade resteasyUpgrade python3-pkiUpgrade jackson-module-jaxb-annotationsUpgrade pki-base-javaUpgrade apache-commons-netUpgrade tomcatjssUpgrade python3-idm-pkiUpgrade jackson-annotationsUpgrade bea-stax-apiUpgrade idm-pki-base-javaUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade relaxngDatatypeUpgrade pki-javadocUpgrade idm-pki-symkeyUpgrade ldapjdkUpgrade javassistUpgrade xalan-j2Upgrade ldapjdk-javadocUpgrade glassfish-fastinfosetUpgrade pki-symkey-debuginfoUpgrade python3-nssUpgrade idm-pki-tools-debuginfoUpgrade pki-core-debugsourceUpgrade glassfish-jaxb-runtimeUpgrade jss-debuginfoUpgrade pki-kraNo solution existsUpgrade xml-commons-apisUpgrade apache-commons-collectionsUpgrade slf4jUpgrade jackson-databindUpgrade idm-pki-symkey-debuginfoUpgrade jackson-jaxrs-providersUpgrade pki-acmeUpgrade pki-core-debuginfoUpgrade pki-baseUpgrade jss-debugsourceUpgrade slf4j-jdk14Upgrade xmlstreambufferUpgrade jackson-coreUpgrade python3-nss-debuginfoUpgrade idm-pki-baseUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade pki-caUpgrade idm-pki-serverUpgrade jssUpgrade pki-symkeyUpgrade jackson-jaxrs-json-providerUpgrade idm-pki-caUpgrade xsomUpgrade xml-commons-resolverUpgrade pki-toolsUpgrade pki-servlet-4.0-api | Nov 3, 2022 | Jul 29, 2022 |
| Rocky_linux | — | Upgrade idm-pki-symkey-debuginfoUpgrade jssUpgrade pki-toolsUpgrade idm-pki-tools-debuginfoUpgrade jss-javadocUpgrade python3-nssUpgrade python3-nss-debuginfoUpgrade jss-debuginfoUpgrade python-nss-docUpgrade idm-pki-symkeyUpgrade pki-core-debuginfoUpgrade jss-debugsourceUpgrade idm-pki-toolsUpgrade python-nss-debugsourceUpgrade pki-core-debugsourceUpgrade pki-symkey | Mar 12, 2024 | Jul 29, 2022 |
| Ubuntu | — | Upgrade pki-base-java (Ubuntu Pro)Upgrade pki-base (Ubuntu Pro)Upgrade pki-ca (Ubuntu Pro)Upgrade dogtag-pki (Ubuntu Pro)Upgrade pki-server (Ubuntu Pro) | Dec 11, 2024 | Jul 29, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub