XML External Entity (XXE)

hazelcast is vulnerable to XML external entity attacks. The AbstractXmlConfigRootTagRecognizer function of AbstractXmlConfigRootTagRecognizer.java does not disable access to external entities by default, allowing an attacker to submit a malicious XML document to perform requests on behalf of the...

XML External Entity Reference in Hazelcast

The AbstractXmlConfigRootTagRecognizer function makes use of SAXParser generated from a SAXParserFactory with no FEATURESECUREPROCESSING set, allowing for XXE attacks...

PT-2022-13080

Name of the Vulnerable Software and Affected Versions hazelcast/hazelcast versions 5.1-BETA-1 through 5.1 Description The issue is related to an improper restriction of XML external entity references, allowing for XXE attacks. The AbstractXmlConfigRootTagRecognizer function uses a SAXParser...

in hazelcast/hazelcast

Description The AbstractXmlConfigRootTagRecognizer function makes use of SAXParser generated from a SAXParserFactory with no FEATURESECUREPROCESSING set, allowing for XXE attacks. In...