Lucene search

GitHub Advisory DatabaseGHSA-FGQ9-FC3Q-VQMW

HistoryOct 25, 2023 - 6:32 p.m.

Withdrawn Advisory: dom4j XML Entity Expansion vulnerability

2023-10-2518:32:23

CWE-776

GitHub Advisory Database

github.com

withdrawn

advisory

dom4j

xml

entity expansion

vulnerability

withdrawn

remote attacker

sensitive information

setfeature function

software

6 Medium

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

JSON

Withdrawn Advisory

This advisory has been withdrawn because the underlying vulnerability could not be reproduced. This link is maintained to preserve external references.

Original Description

An issue in dom4.j org.dom4.io.SAXReader v.2.1.4 and before allows a remote attacker to obtain sensitive information via the setFeature function.

Affected configurations

Vulners

Node

org.dom4j\Matchdom4j

CPENameOperatorVersion
org.dom4j:dom4jle2.1.4

CPE	Name	Operator	Version
	org.dom4j:dom4j	le	2.1.4

References

dom4j.github.io/

github.com/advisories/GHSA-fgq9-fc3q-vqmw

github.com/dom4j/dom4j/issues/171#issuecomment-1781547256

github.com/joker-xiaoyan/XXE-SAXReader/blob/8c0d24f9800c36c8ad36457c1df1e4aaff24c7b9/POC.java

github.com/joker-xiaoyan/XXE-SAXReader/issues/1

github.com/joker-xiaoyan/XXE-SAXReader/tree/main

nvd.nist.gov/vuln/detail/CVE-2023-45960