~ / search / GHSA-rc57-9r3x-98cq

GHSA-rc57-9r3x-98cq

XML External Entity Reference in drools

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-41411

Packages

EcosystemPackageAffectedFixed in
Maven org.drools:drools-core < 7.60.0.Final 7.60.0.Final

Details

As written in the advisory (Markdown source, shown as plain text).

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

References

External links from the advisory. They lead to third-party sites.