-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from XML parsing in getXmlDoc() where DocumentBuilderFactory was configured with setExpandEntityReferences(false) but lacked setFeature("http://apache.org/xml/features/disallow-doctype-decl", true). This allowed DOCTYPE declarations and external entity references. The patched commit 8ec61d1 explicitly adds this missing feature in getXmlDoc(), confirming this was the vulnerable function. The test case in BaseWxPayResultTest.java also demonstrates XXE exploitation attempts against this method.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.github.binarywang:weixin-java-common | maven | < 3.3.2.B | 3.3.2.B |