CVE-2023-48362 Apache Drill: XXE Vulnerability in XML Format Reader

2024-07-2407:45:43

CWE-611

apache

www.cve.org

apache drill

xml format reader

xxe vulnerability

cve-2023-48362

upgrade

EPSS

0.001

Percentile

48.4%

JSON

XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file.
Users are recommended to upgrade to version 1.21.2, which fixes this issue.

CNA Affected

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.drill.contrib:drill-format-xml",
    "product": "Apache Drill",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "1.21.2",
        "status": "affected",
        "version": "1.19.0",
        "versionType": "semver"
      }
    ]
  }
]