6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-4949

CVE-2025-4949: XXE vulnerability in Eclipse JGit

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-4949

CVE-2025-4949:

6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.eclipse.jgit:org.eclipse.jgit	maven	>= 7.2.0.202503040940-r, < 7.2.1.202505142326-r	7.2.1.202505142326-r
org.eclipse.jgit:org.eclipse.jgit	maven	>= 7.1.0.202411261347-r, < 7.1.1.202505221757-r	7.1.1.202505221757-r
org.eclipse.jgit:org.eclipse.jgit	maven	>= 7.0.0.202409031743-r, < 7.0.1.202505221510-r	7.0.1.202505221510-r
org.eclipse.jgit:org.eclipse.jgit	maven	< 6.10.1.202505221210-r	6.10.1.202505221210-r

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description explicitly mentions that the ManifestParser and AmazonS3 classes are vulnerable to XXE attacks due to improper XML parsing.

ManifestParser: The commit dab4f52d49a4638142027b916e31a5a470df7f03 patches the read method in org.eclipse.jgit/src/org/eclipse/jgit/gitrepo/ManifestParser.java. Before the patch, this method initialized a SAXParserFactory and used it to create an XMLReader without disabling features that allow XXE (like external general entities, external parameter entities, and DOCTYPE declarations). The patch adds calls to setFeature on the SAXParserFactory instance to disable these dangerous features. The vulnerability report also includes a test case (testXXE in ManifestParserTest.java) that demonstrates the XXE by calling this read method with a malicious XML input.
AmazonS3: The commit c6fc3607079022e95b018b60c830b3da63bf6fef patches the list method in org.eclipse.jgit/src/org/eclipse/jgit/transport/AmazonS3.java. Similar to ManifestParser, this method used a SAXParserFactory to parse XML (likely S3 bucket listing responses) without properly securing it against XXE. The patch applies the same setFeature calls to the SAXParserFactory to prevent the processing of external entities and DOCTYPE declarations.

Both functions were vulnerable because they parsed XML input without configuring the XML parser to prevent XXE attacks. The patches directly address this by disabling the relevant features in the SAXParserFactory used within these methods. Therefore, these methods would be directly involved in processing the malicious XML if the vulnerability were exploited and would appear in a runtime profile.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.