Lucene search

Debian Security Bug TrackerDEBIANCVE:CVE-2023-45960

HistoryOct 25, 2023 - 6:17 p.m.

CVE-2023-45960

2023-10-2518:17:35

Debian Security Bug Tracker

security-tracker.debian.org

dom4j

saxreader

vulnerability

sensitive information

setfeature

remote attacker

vendor

unsafe

feature

unix

7.3 High

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

JSON

An issue in dom4.j org.dom4.io.SAXReader v.2.1.4 and before allows a remote attacker to obtain sensitive information via the setFeature function. NOTE: the vendor and original reporter indicate that this is not a vulnerability because setFeature only sets features, which “can be safe in one case and unsafe in another.”

OSVersionArchitecturePackageVersionFilename
Debian12alldom4j<= 2.1.3-2dom4j_2.1.3-2_all.deb
Debian11alldom4j<= 2.1.3-1dom4j_2.1.3-1_all.deb
Debian10alldom4j<= 2.1.1-2dom4j_2.1.1-2_all.deb
Debian999alldom4j<= 2.1.3-2dom4j_2.1.3-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	dom4j	<= 2.1.3-2	dom4j_2.1.3-2_all.deb
Debian	11	all	dom4j	<= 2.1.3-1	dom4j_2.1.3-1_all.deb
Debian	10	all	dom4j	<= 2.1.1-2	dom4j_2.1.1-2_all.deb
Debian	999	all	dom4j	<= 2.1.3-2	dom4j_2.1.3-2_all.deb