XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

🗓️ 08 Nov 2024 00:00:00Reported by https://gitlab.com/gitlab-org/security-products/gemnasium-dbType

XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`. Vulnerability in XML parsing via XSLT in `org.hl7.fhir.core` allows data extraction from the host system when processing XML files with malicious DTD tag

Reporter	Title	Published	Views	Family All 33
Circl	CVE-2024-52007	9 Nov 202400:44	–	circl
CNNVD	HAPI FHIR 代码问题漏洞	8 Nov 202400:00	–	cnnvd
CVE	CVE-2024-52007	8 Nov 202422:28	–	cve
Cvelist	CVE-2024-52007 XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`	8 Nov 202422:28	–	cvelist
EUVD	EUVD-2024-3256	3 Oct 202520:07	–	euvd
Github Security Blog	XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`	8 Nov 202418:49	–	github
GitLab Advisory Database	XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`	8 Nov 202400:00	–	gitlab
GitLab Advisory Database	XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`	8 Nov 202400:00	–	gitlab
GitLab Advisory Database	XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`	8 Nov 202400:00	–	gitlab
GitLab Advisory Database	XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`	8 Nov 202400:00	–	gitlab

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-52007
github	www.github.com/advisories/GHSA-gr3c-q7xf-47vh
github	www.github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf
github	www.github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-gr3c-q7xf-47vh
github	www.github.com/hapifhir/org.hl7.fhir.core/issues/1571
github	www.github.com/hapifhir/org.hl7.fhir.core/pull/1717
cheatsheetseries	www.cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
cwe	www.cwe.mitre.org/data/definitions/611.html
github	www.github.com/hapifhir/org.hl7.fhir.core

08 Nov 2024 00:00Current

8.4High risk

Vulners AI Score8.4

CVSS 3.18.6

EPSS0.00918

SSVC