XML External Entity (XXE)

adal4j is vulnerable to XML External Entity XXE. The vulnerability exists because the external DTDs are not disabled by default in WSTrustResponse parse function in WSTrustResponse.java and getWsTrustEndpointFromMexResponse function in MexParser.java, allowing an attacker to submit a malicious XM...