CVE-2024-52807: falha de alta gravidade em HL7 fhir-ig-publisher
XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar fhir-ig-publisher+ Monitorar org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.6%
The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.7.4, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag `( ]>` could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.publisher is being used to within a host where external clients can submit XML. A previous release provided an incomplete solution revealed by new testing. This issue has been patched as of version 1.7.4. No known workarounds are available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
HL7 · fhir-ig-publisherCVEs relacionadas — HL7 fhir-ig-publisher
No mesmo produto, das mais perigosas para as menos.