HAPI FHIR XML External Entity (XXE) vulnerability

An XML External Entity XXE vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities...

HAPI FHIR XML External Entity (XXE) vulnerability

An XML External Entity XXE vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities...

PT-2024-34533

Name of the Vulnerable Software and Affected Versions: HAPI FHIR versions prior to 6.4.0 Description: The issue allows attackers to access sensitive information or execute arbitrary code by supplying a crafted request containing malicious XML entities. This is due to an XML External Entity XXE...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +168 more potentially affected by CVE-2024-38820 via org.springframework:spring-context (4.3.0.release)

org.springframework:spring-context MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +79 more potentially affected by CVE-2024-38820 via org.springframework:spring-web (4.3.0.release)

org.springframework:spring-web MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 - ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (3.0.0), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (3.0.0) +863 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (4.3.10.release)

org.springframework:spring-web MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 3.0.0 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (0.0.1), ca.uhn.hapi.fhir:org.hl7.fhir.validation (0.0.1) potentially affected by CVE-2024-45294 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (0.0.1)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 0.0.1 - ca.uhn.hapi.fhir:org.hl7.fhir.validation 0.0.1...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (0.0.2), ca.uhn.hapi.fhir:org.hl7.fhir.validation (0.0.2) potentially affected by CVE-2024-45294 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (0.0.2)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 0.0.2 - ca.uhn.hapi.fhir:org.hl7.fhir.validation 0.0.2...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (1.0.0), ca.uhn.hapi.fhir:org.hl7.fhir.report (1.0.0) +1 more potentially affected by CVE-2024-45294 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (1.0.0)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 1.0.0 - ca.uhn.hapi.fhir:org.hl7.fhir.report 1.0.0 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (1.1.67), ca.uhn.hapi.fhir:org.hl7.fhir.validation (1.1.67) potentially affected by CVE-2024-45294 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (1.1.67)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 1.1.67 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 1.1.67 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=4.0.0, <=4.0.1), ca.uhn.hapi.fhir:hapi-fhir-igpacks (>=4.0.0, <=4.0.1) +10 more potentially affected by CVE-2024-45294 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (4.0.0)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (4.0.3), ca.uhn.hapi.fhir:hapi-fhir-converter (4.0.3) +15 more potentially affected by CVE-2024-45294 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (4.0.3)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 4.0.3 - ca.uhn.hapi.fhir:hapi-fhir-converter 4.0.3 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (4.1.0), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (4.1.0) +70 more potentially affected by CVE-2024-45294 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (4.1.0)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 4.1.0 - ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver 4.1.0 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.0.0, <=5.0.2), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=5.0.0, <=5.0.2) +53 more potentially affected by CVE-2024-45294 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.0.0)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0,...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.8), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.8) potentially affected by CVE-2024-45294 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.0.8)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.0.8 - ca.uhn.hapi.fhir:org.hl7.fhir.validation 5.0.8...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.9), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.9) potentially affected by CVE-2024-45294 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.0.9)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.0.9 - ca.uhn.hapi.fhir:org.hl7.fhir.validation 5.0.9...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.10), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.10) +3 more potentially affected by CVE-2024-45294 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.0.10)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.0.10 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.11), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.11) potentially affected by CVE-2024-45294 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.0.11)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.0.11 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.12), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.12) +3 more potentially affected by CVE-2024-45294 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.0.12)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.0.12 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.0.12 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.0.14), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.0.14) +3 more potentially affected by CVE-2024-45294 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.0.14)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.0.14 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.0.14 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...