-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in multiple locations across the mustangproject codebase where XML parsing is performed without proper security configurations. The identified functions all use javax.xml.parsers.DocumentBuilderFactory to create an XML parser. However, they failed to disable the processing of external entities, which is the root cause of the XML External Entity (XXE) vulnerability (CWE-611). An attacker could supply a specially crafted XML document containing external entity references to local files on the server. When the application parses this XML, it would resolve these entities and embed the content of the files into the XML data, which could then be returned in an error message or another part of the application's output, leading to information disclosure. The patch addresses this by explicitly setting features on the DocumentBuilderFactory instance to disable DTDs and external entities, such as setExpandEntityReferences(false), setFeature("http://apache.org/xml/features/disallow-doctype-decl", true), and setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true).
org.mustangproject.ZUGFeRD.ZUGFeRDInvoiceImporter.setDocumentlibrary/src/main/java/org/mustangproject/ZUGFeRD/ZUGFeRDInvoiceImporter.java
org.mustangproject.ZUGFeRD.ZUGFeRDVisualizer.findOutStandardFromRootNodelibrary/src/main/java/org/mustangproject/ZUGFeRD/ZUGFeRDVisualizer.java
org.mustangproject.validator.XMLValidator.validatevalidator/src/main/java/org/mustangproject/validator/XMLValidator.java
org.mustangproject.validator.ZUGFeRDValidator.internalValidatevalidator/src/main/java/org/mustangproject/validator/ZUGFeRDValidator.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.mustangproject:library | maven | < 2.16.3 | 2.16.3 |
| org.mustangproject:validator | maven | < 2.16.3 | 2.16.3 |