-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure XML parser configuration. The commit fix shows the vulnerable code created an XMLInputFactory instance without setting SUPPORT_DTD=false. This allowed processing of external entities via DTDs, enabling XXE attacks. The patch explicitly adds 'inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false)' to mitigate this. The test case added in TestXMLReader.java with bad.xml demonstrates the XXE scenario that would have been exploitable before this fix.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.drill.exec:drill-java-exec | maven | >= 1.19.0, < 1.21.2 | 1.21.2 |
JavaJavaKEV Misses 88% of Exploited CVEs- Get the report