XML External Entity (XXE) Injection

Apache Phoenix is vulnerable to XML external entities XXE Injection attacks. The application does not disable DTD parsing by default, allowing a malicious user to inject external XML entities...