Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.
This issue affects Apache XML Graphics FOP: 2.9.
Users are recommended to upgrade to version 2.10, which fixes the issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade fop | Nov 18, 2024 | Oct 9, 2024 |
| Debian | — | Upgrade fop | May 15, 2025 | Oct 9, 2024 |
| Suse | — | Upgrade xmlgraphics-batik-slideshowUpgrade javapackages-localUpgrade xmlgraphics-batik-rasterizerUpgrade xmlgraphics-batik-squiggleUpgrade xmlgraphics-batik-svgppUpgrade xmlgraphics-fopUpgrade xmlgraphics-batik-ttf2svgUpgrade xmlgraphics-commons-javadocUpgrade javapackages-gradleUpgrade javapackages-ivyUpgrade xmlgraphics-batik-javadocUpgrade javapackages-filesystemUpgrade javapackages-toolsUpgrade python3-javapackagesUpgrade xmlgraphics-batik-cssUpgrade xmlgraphics-commonsUpgrade xmlgraphics-batikUpgrade xmlgraphics-batik-demo | Dec 5, 2025 | Nov 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub