GHSA-pgrc-8wp5-5mvq

powertac-server XML External Entity vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-51135

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.powertac:server-interface	<= 1.9.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An XML External Entity (XXE) vulnerability in the component DocumentBuilderFactory of powertac-server v1.9.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-51135 advisory
https://github.com/powertac/powertac-server/issues/1166 web
https://github.com/powertac/powertac-server package
https://mvnrepository.com/artifact/org.powertac/server-interface web