GHSA-p2qf-9vp6-3jjq

ghsaUSosv

HuTool XML parsing module has blind XXE vulnerability

view advisory published 2023-06-15Licence: CC-BY-4.0

A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-3276US	high7.5	0.73% (54th)	—	2023-06-15
A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of th…

references

External citations — patches, advisories, analysis.

https://fbdhhhh47.github.io/2023/06/06/hutool-XXEWEB
https://github.com/dromara/hutoolPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2023-3276ADVISORY
https://vuldb.com/?ctiid.231626WEB
https://vuldb.com/?id.231626WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan