CVE-2021-41042CWE-611

In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML

published July 7, 2022

CVSS
—
EPSS
1%
Percentile
62.6
In the wild
Unconfirmed
What it is

In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01002 · 62.6th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2022-07-07T20:55Z
EPSS history
Timeline
  • 07 JUL 20:55Z
    In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML
    cvelistv5