CVE-2024-51132

HAPI FHIR versions before v6.4.0 are vulnerable to an XML External Entity (XXE) injection. This flaw exists across multiple modules, including org.hl7.fhir.convertors, org.hl7.fhir.dstu2, org.hl7.fhir.dstu3, org.hl7.fhir.r4, org.hl7.fhir.r4b, org.hl7.fhir.r5, org.hl7.fhir.utilities, and org.hl7.f...

CVE-2024-51132

An XML External Entity XXE vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities...

HAPI FHIR 安全漏洞

HAPI FHIR is a Java-written HL7 FHIR API for the HAPI FHIR open source. A security vulnerability exists in HAPI FHIR versions prior to v6.4.0 that stems from the presence of an external entity reference that allows an attacker to access sensitive information or execute arbitrary code by providing...

HAPI FHIR XML External Entity (XXE) vulnerability

An XML External Entity XXE vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities...

CVE-2024-51132: Improper Restriction of XML External Entity Reference

An XML External Entity XXE vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities...

HAPI FHIR XML External Entity (XXE) vulnerability

An XML External Entity XXE vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities...

PT-2024-34533

Name of the Vulnerable Software and Affected Versions: HAPI FHIR versions prior to 6.4.0 Description: The issue allows attackers to access sensitive information or execute arbitrary code by supplying a crafted request containing malicious XML entities. This is due to an XML External Entity XXE...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +168 more potentially affected by CVE-2024-38820 via org.springframework:spring-context (4.3.0.release)

org.springframework:spring-context MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (3.0.0), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (3.0.0) +863 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (4.3.10.release)

org.springframework:spring-web MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 3.0.0 -...

PT-2024-35091

Name of the Vulnerable Software and Affected Versions HAPI FHIR versions prior to 6.4.0 Description The XSLT parsing performed by various components in HAPI FHIR is vulnerable to XML external entity injections. This issue can be exploited by submitting a malicious XML file with a DTD tag,...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=2.0, <=2.2) +348 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (4.3.1.release)

org.springframework:spring-expression MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =2.0, =2.0, =2.1.0-release,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.1.0, <=5.2.1), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=5.1.0, <=5.2.1) +59 more potentially affected by CVE-2024-23444 via org.elasticsearch:elasticsearch (6.5.4)

org.elasticsearch:elasticsearch MAVEN version 6.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.2.0, <=6.2.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.2.0, <=6.2.5) +20 more potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (17.4)

com.graphql-java:graphql-java MAVEN version 17.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.4.0, <=6.6.2), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.4.0, <=6.6.2) +343 more potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (>=19.0, <=19.8)

com.graphql-java:graphql-java MAVEN version =19.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =2.0.4, =1.6.9, =14.3.0, =17.7.0 - com.datasqrl:sqrl-base 0.6.0 and more Source cves: CVE-2024-40094 Source advisory: OSV:GHSA-H9MQ-F6Q5-6C8M...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=7.2.0, <=7.4.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=7.2.0, <=7.4.5) +409 more potentially affected by CVE-2023-7272 via org.eclipse.parsson:parsson (>=1.0.0, <=1.0.3)

org.eclipse.parsson:parsson MAVEN version =1.0.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =1.0, =0.3.8, =0.3.0, =0.2.3, =1.1.0, =1.4.4 and more Source cves: CVE-2023-7272 Source advisory: GHSA-2RWM-XV5J-777P...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=7.2.0, <=7.4.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=7.2.0, <=7.4.5) +409 more potentially affected by CVE-2023-7272 via org.eclipse.parsson:parsson (>=1.0.0, <=1.0.3)

org.eclipse.parsson:parsson MAVEN version =1.0.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =1.0, =0.3.8, =0.3.0, =0.2.3, =1.1.0, =1.4.4 and more Source cves: CVE-2023-7272 Source advisory: OSV:GHSA-2RWM-XV5J-777P...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=7.2.0, <=7.4.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=7.2.0, <=7.4.5) +409 more potentially affected by CVE-2023-7272 via org.eclipse.parsson:parsson (>=1.0.0, <=1.0.3)

org.eclipse.parsson:parsson MAVEN version =1.0.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =1.0, =0.3.8, =0.3.0, =0.2.3, =1.1.0, =1.4.4 and more Source cves: CVE-2023-7272 Source advisory: MEND:CVE-2023-7272...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (3.0.0), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (3.0.0) +863 more potentially affected by CVE-2024-22259 via org.springframework:spring-web (4.3.10.release)

org.springframework:spring-web MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 3.0.0 -...

ca.uhn.hapi.fhir:hapi-fhir-spring-boot-sample-client-apache (6.6.0), ca.uhn.hapi.fhir:hapi-fhir-spring-boot-sample-client-okhttp (6.6.0) +440 more potentially affected by CVE-2023-34981 via org.apache.tomcat.embed:tomcat-embed-core (9.0.74)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 9.0.74 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-spring-boot-sample-client-apache 6.6.0 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.0.0, <=3.4.0) +1617 more potentially affected by CVE-2023-20863 via org.springframework:spring-expression (4.3.10.release)

org.springframework:spring-expression MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 -...