GHSA-4cf2-cxp3-rjr7HighCVSS 9.8

HAPI FHIR XML External Entity (XXE) vulnerability

Published
November 5, 2024
Last Modified
November 6, 2024

🔗 CVE IDs covered (1)

CVE-2024-51132 →

📋 Description

An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.

🎯 Affected products9

  • maven/ca.uhn.hapi.fhir:org.hl7.fhir.convertors:< 6.4.0
  • maven/ca.uhn.hapi.fhir:org.hl7.fhir.dstu2:< 6.4.0
  • maven/ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may:< 6.4.0
  • maven/ca.uhn.hapi.fhir:org.hl7.fhir.dstu3:< 6.4.0
  • maven/ca.uhn.hapi.fhir:org.hl7.fhir.r4:< 6.4.0
  • maven/ca.uhn.hapi.fhir:org.hl7.fhir.r4b:< 6.4.0
  • maven/ca.uhn.hapi.fhir:org.hl7.fhir.r5:< 6.4.0
  • maven/ca.uhn.hapi.fhir:org.hl7.fhir.utilities:< 6.4.0
  • maven/ca.uhn.hapi.fhir:org.hl7.fhir.validation:< 6.4.0

🔗 References (5)