-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from multiple XML parsing locations using DocumentBuilderFactory.newInstance() without security configurations. The patch introduced a hardened newDocumentBuilderFactory() method to disable DTDs and external entities. The vulnerable functions all contained the pattern:
This matches classic XXE vulnerability patterns where XML parsers are not properly secured against external entity expansion.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.zeppelin:sap | maven | >= 0.8.0, < 0.11.0 | 0.11.0 |
JavaJavaOngoing coverage of React2Shell