GHSA-4cf2-cxp3-rjr7
HAPI FHIR XML External Entity (XXE) vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.convertors | < 6.4.0 | 6.4.0 |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 | < 6.4.0 | 6.4.0 |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may | < 6.4.0 | 6.4.0 |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 | < 6.4.0 | 6.4.0 |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r4 | < 6.4.0 | 6.4.0 |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r4b | < 6.4.0 | 6.4.0 |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r5 | < 6.4.0 | 6.4.0 |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.utilities | < 6.4.0 | 6.4.0 |
| Maven | ca.uhn.hapi.fhir:org.hl7.fhir.validation | < 6.4.0 | 6.4.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.
References
External links from the advisory. They lead to third-party sites.