Severity
8.3
High severity
Details
- CVSS score
- 8.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Overview
About vulnerability
Any caller that can deliver bytes to a Netty channel pipeline containingXmlDecoder can send XML with a DOCTYPE declaration to a parser instantiated with no security configuration — but whether external entities are actually resolved depends on Aalto XML’s async parser behavior, making this a confirmed misconfiguration with conditional exploitability.
Details
- Affected product:
- Apache CXF , Apache Hadoop , Apache Kafka , Apache Log4j , Apache Maven , Apache Solr , Apache Spark , Eclipse Jetty , Elasticsearch , Netty , Spring , Wildfly , alluxio , amqp-10-jms-spring-boot , artemis , async-http-client , avro , aws-sdk-java , aws-sdk-java-v2 , azure-sdk-for-java , azure-search-documents , bolt-connection-java , bookkeeper , bookkeeper-common-allocator , camel , cassandra-java-driver , corda , couchbase-jvm-clients-core-io , couchbase-jvm-clients-java-client , curator , cypher-dsl , distributedlog , flink , flink-shaded , flume , grpc-java , hbase , hbase-thirdparty , infinispan , jaeger-analytics-java , java-driver , jersey , lettuce , logging-flume , metrics , micrometer , micronaut-core , neo4j-java-driver , neo4j-ogm , olingo-odata4 , pinecone-java-client , pulsar , qpid-jms , rabbitmq-java-client , rabbitmq-stream-java-client , redisson , rsocket-java , tika , zookeeper
- Affected packages:
- connect @ 3.5.2 (+13134 more)