ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.0.0, <=6.10.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.0.3, <=6.10.5) +275 more potentially affected by CVE-2024-52981 via org.elasticsearch:elasticsearch (>=7.17.0, <=7.17.23)

org.elasticsearch:elasticsearch MAVEN version =7.17.0, =6.0.0, =6.0.3, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.0, =6.8.0, =6.4.0, =6.0.0, =6.0.0, =6.0.3, =6.8.0, =1.0, =1.0.0, =6.0.01 and more Source cves: CVE-2024-52981 Source advisory: OSV:GHSA-5XM9-X7X4-4J5X...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.0.0, <=6.10.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.0.3, <=6.10.5) +275 more potentially affected by CVE-2024-52981 via org.elasticsearch:elasticsearch (>=7.17.0, <=7.17.23)

org.elasticsearch:elasticsearch MAVEN version =7.17.0, =6.0.0, =6.0.3, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.0, =6.8.0, =6.4.0, =6.0.0, =6.0.0, =6.0.3, =6.8.0, =1.0, =1.0.0, =6.0.01 and more Source cves: CVE-2024-52981 Source advisory: MEND:CVE-2024-52981...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.0.0, <=6.10.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.0.3, <=6.10.5) +251 more potentially affected by CVE-2024-52981 via org.elasticsearch:elasticsearch-geo (>=7.17.0, <=7.17.23)

org.elasticsearch:elasticsearch-geo MAVEN version =7.17.0, =6.0.0, =6.0.3, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.0, =6.8.0, =6.4.0, =6.0.0, =6.0.0, =6.0.3, =6.8.0, =1.0, =1.0.0, =6.0.01 and more Source cves: CVE-2024-52981 Source advisory: MEND:CVE-2024-52981...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.1.0, <=5.2.1), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=5.1.0, <=5.2.1) +59 more potentially affected by CVE-2024-43709 via org.elasticsearch:elasticsearch (6.5.4)

org.elasticsearch:elasticsearch MAVEN version 6.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +26 more potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (4.3.0.release)

org.springframework:spring-webmvc MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=4.0.0, <=7.6.1), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=5.6.5, <=7.4.5) +272 more potentially affected by CVE-2024-55887 via org.fhir:ucum (>=1.0.1, <=1.0.8)

org.fhir:ucum MAVEN version =1.0.1, =4.0.0, =5.6.5, =4.1.0, =4.1.0, =4.0.0, =4.0.0, =5.0.0, =4.0.0, =5.3.0, =6.2.0, =5.1.0, =6.8.0, =6.4.0, =5.3.0, =7.6.1 and more Source cves: CVE-2024-55887 Source advisory: OSV:GHSA-W9J7-PHM3-F97J...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=4.0.0, <=7.6.1), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=5.6.5, <=7.4.5) +272 more potentially affected by CVE-2024-55887 via org.fhir:ucum (>=1.0.1, <=1.0.8)

org.fhir:ucum MAVEN version =1.0.1, =4.0.0, =5.6.5, =4.1.0, =4.1.0, =4.0.0, =4.0.0, =5.0.0, =4.0.0, =5.3.0, =6.2.0, =5.1.0, =6.8.0, =6.4.0, =5.3.0, =7.6.1 and more Source cves: CVE-2024-55887 Source advisory: GHSA-W9J7-PHM3-F97J...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=4.0.0, <=7.6.1), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=5.6.5, <=7.4.5) +272 more potentially affected by CVE-2024-55887 via org.fhir:ucum (>=1.0.1, <=1.0.8)

org.fhir:ucum MAVEN version =1.0.1, =4.0.0, =5.6.5, =4.1.0, =4.1.0, =4.0.0, =4.0.0, =5.0.0, =4.0.0, =5.3.0, =6.2.0, =5.1.0, =6.8.0, =6.4.0, =5.3.0, =7.6.1 and more Source cves: CVE-2024-55887 Source advisory: MEND:CVE-2024-55887...

XML External Entity (XXE) Injection

HAPI FHIR is vulnerable to XML External Entity XXE Injection. The vulnerability is due to insecure XML parsing by HAPI FHIR, specifically within the XSLT parsing components, which improperly handle external entity references in XML files. It allows attackers to inject malicious XML content, such ...

org.hl7.fhir.convertors: org.hl7.fhir.dstu2: org.hl7.fhir.dstu2016may: org.hl7.fhir.dstu3: org.hl7.fhir.r4: org.hl7.fhir.r5: org.hl7.fhir.utilities: org.hl7.fhir.validation: org.hl7.fhir.core: FHIR arbitrary code execution via specially-crafted request

A flaw was found in Fast Healthcare Interoperability Resources HAPI FHIR. This vulnerability could allow attackers to execute arbitrary code or access sensitive information via a crafted request which contains malicious XML entities...

XML External Entity (XXE)

hapi fhir is vulnerable to XML External Entity XXE. The vulnerability is due to improper handling of XML input. Specifically, the system fails to properly disable or validate external entities within XML documents, allowing attackers to inject malicious XML that can lead to unauthorized data acce...

CVE-2024-52007

A flaw was found in HAPI FHIR - HL7 FHIR Core Artifacts. eXtensible Stylesheet Language Transformations XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host...

CVE-2024-52007

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host...

CVE-2024-52007 XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host...

CVE-2024-52007

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=3.4.0, <=7.4.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=5.6.5, <=7.4.5) +234 more potentially affected by CVE-2024-52007 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (>=0.0.1, <=6.3.32)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version =0.0.1, =3.4.0, =5.6.5, =4.1.0, =4.0.3, =4.1.0, =4.0.0, =5.0.0, =4.0.0, =5.3.0, =6.2.0, =5.1.0, =6.8.0, =6.4.0, =5.3.0, =4.0.0, =5.5.7 and more Source cves: CVE-2024-52007 Source advisory: MEND:CVE-2024-52007...

CVE-2024-52007

CVE-2024-52007 is an XXE vulnerability in XSLT parsing within the HAPI FHIR org.hl7.fhir.core components. The issue arises from XML external entity injections when processing XML with a malicious DTD, potentially allowing host data to be exposed. The Red Hat advisory notes this is fixed by upgrad...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.1.15), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.1.15) +8 more potentially affected by CVE-2024-52007 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (5.1.15)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 5.1.15 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.1.15 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.1.9), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.1.9) +8 more potentially affected by CVE-2024-52007 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (5.1.9)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 5.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.1.9 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.5.2), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.5.2) +5 more potentially affected by CVE-2024-52007 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (5.5.2)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 5.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.5.2 -...