GHSA-rc57-9r3x-98cq

ghsaUSosv

XML External Entity Reference in drools

view advisory published 2022-06-17Licence: CC-BY-4.0

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-41411US	critical9.8	1.29% (70th)	—	2022-06-16
drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vul…

references

External citations — patches, advisories, analysis.

https://github.com/apache/incubator-kie-drools/pull/3808WEB
https://github.com/kiegroup/droolsPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2021-41411ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan