What is GHSA-p2qf-9vp6-3jjq?

GHSA-p2qf-9vp6-3jjq is a security advisory published by GitHub Security Advisories with High severity. HuTool XML parsing module has blind XXE vulnerability

Which CVE IDs does GHSA-p2qf-9vp6-3jjq cover?

GHSA-p2qf-9vp6-3jjq covers the following CVE IDs: CVE-2023-3276. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p2qf-9vp6-3jjq?

GHSA-p2qf-9vp6-3jjq has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-p2qf-9vp6-3jjq?

GHSA-p2qf-9vp6-3jjq affects 1 product, including: maven/cn.hutool:hutool-core:\u003c= 5.8.19.

GHSA-p2qf-9vp6-3jjqHighCVSS 7.5

HuTool XML parsing module has blind XXE vulnerability

Vendor

GitHub Security Advisories

Published

June 15, 2023

Last Modified

March 1, 2024

🔗 CVE IDs covered (1)

CVE-2023-3276 →

📋 Description

A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference.

🎯 Affected products1

maven/cn.hutool:hutool-core:<= 5.8.19

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-3276
https://vuldb.com/?ctiid.231626
https://vuldb.com/?id.231626
https://fbdhhhh47.github.io/2023/06/06/hutool-XXE
https://github.com/advisories/GHSA-p2qf-9vp6-3jjq