CVE-2024-55887CWE-611

Ucum-java has an XXE vulnerability in XML parsing

High · published December 13, 2024

CVSS v3.1
8.6
EPSS
1%
Percentile
45.8
In the wild
Unconfirmed
What it is

Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML. Release 1.0.9 of Ucum-java fixes this vulnerability. As a workaround, ensure that the source xml for instantiating UcumEssenceService is trusted.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00557 · 45.8th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2024-12-13T16:08Z
EPSS history
Timeline
  • 13 DEC 16:08Z
    Ucum-java has an XXE vulnerability in XML parsing
    cvelistv5