CVE-2024-36522

2024-07-1213:15:11

CWE-74

[email protected]

web.nvd.nist.gov

xsltresourcestream.java

remote code execution

xslt injection

untrusted source

validation

upgrade

versions 10.1.0

9.18.0

8.16.0

cve-2024-36522

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

9.3%

JSON

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation.
Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue.