-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.opennms.core:org.opennms.core.xml | maven | >= 31.0.8, < 32.0.2 | 32.0.2 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from improper XML parsing configuration in JaxbUtils.java. The commit diff shows the vulnerable version had SAX feature flags for external entities (external-general-entities and external-parameter-entities) set to false ONLY when disableDOCTYPE=true. This meant when disableDOCTYPE=false (the default in some contexts), external entities could be processed. The patch moved these security-critical feature disables outside the conditional block, ensuring they're always disabled regardless of doctype handling - directly addressing the XXE vulnerability through proper feature configuration.
Ongoing coverage of React2Shell