CVE-2023-49733CWE-611

CVE-2023-49733: vulnerability in Apache Cocoon

Apache Cocoon's StreamGenerator is vulnerable to XXE injection

Published · Updated

Follow this CVE+ Monitor Apache Cocoon+ Monitor org.apache.cocoon:cocoon

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.3%
Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.
Affected products
Apache Software Foundation · Apache Cocoon
Related CVEs — Apache Cocoon

In the same product, most dangerous first.

CVE-2022-45135CRITICALApache Cocoon: SQL injection in DatabaseCookieAuthenticatorActionEPSS 1.1%CVE-2025-24783HIGHApache Cocoon: continuations may not be privateEPSS 0.8%CVE-2026-108089HIGHApache Cocoon: Unauthenticated access to diagnostic interfacesEPSS 0.5%CVE-2026-108088HIGHApache Cocoon: Cross-user cache poisoningEPSS 0.5%CVE-2026-108087HIGHApache Cocoon: SQL InjectionEPSS 0.4%CVE-2026-108086HIGHApache Cocoon: XEE could lead to SSRF and information disclosureEPSS 0.4%