Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    1 vulnerability by Eclipse JGit

    CVE-2025-4949 (GCVE-0-2025-4949)

    Vulnerability from cvelistv5 – Published: 2025-05-21 06:47 – Updated: 2025-10-14 06:30
    VLAI
    Title
    XXE vulnerability in Eclipse JGit
    Summary
    In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.
    Severity
    6.8 (Medium)
    CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:Y/R:U/V:D/RE:L/U:Green
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-611 - Improper Restriction of XML External Entity Reference
    • CWE-827 - Improper Control of Document Type Definition
    Assigner
    References
    Impacted products
    Vendor Product Version
    Eclipse JGit Eclipse JGit Affected: 7.2.0 , < 7.2.1.202505142326-r (osgi)
    Affected: 7.1.0 , < 7.1.1.202505221757-r (osgi)
    Affected: 7.0.0 , < 7.0.1.202505221510-r (osgi)
    Affected: 0 , < 5.13.4.202507202350-r (osgi)
    Affected: 6.0.0 , < 6.10.1.202505221210-r (osgi)
    		Create a notification for this product.
    Credits
    Simon Gerst (intrigus-lgtm) https://intrigus.org
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-4949",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-21T10:22:48.944398Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-21T10:24:58.815Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://projects.eclipse.org",
          "defaultStatus": "unaffected",
          "product": "Eclipse JGit",
          "repo": "https://github.com/eclipse-jgit/jgit",
          "vendor": "Eclipse JGit",
          "versions": [
            {
              "lessThan": "7.2.1.202505142326-r",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "osgi"
            },
            {
              "lessThan": "7.1.1.202505221757-r",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "osgi"
            },
            {
              "lessThan": "7.0.1.202505221510-r",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "osgi"
            },
            {
              "lessThan": "5.13.4.202507202350-r",
              "status": "affected",
              "version": "0",
              "versionType": "osgi"
            },
            {
              "lessThan": "6.10.1.202505221210-r",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "osgi"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "pkg:maven/org.eclipse.jgit/org.eclipse.jgit",
          "product": "Eclipse JGit",
          "repo": "https://github.com/eclipse-jgit/jgit",
          "vendor": "Eclipse JGit",
          "versions": [
            {
              "lessThan": "7.2.1.202505142326-r",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "osgi"
            },
            {
              "lessThan": "7.1.1.202505221757-r",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "osgi"
            },
            {
              "lessThan": "7.0.1.202505221510-r",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "osgi"
            },
            {
              "lessThan": "5.13.4.202507202350-r",
              "status": "affected",
              "version": "0",
              "versionType": "osgi"
            },
            {
              "lessThan": "6.10.1.202505221210-r",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "osgi"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Simon Gerst (intrigus-lgtm) https://intrigus.org"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Eclipse JGit versions 7.2.0.202503040940-r and older, the \u003ccode\u003eManifestParser\u003c/code\u003e class used by the \u003ccode\u003erepo\u003c/code\u003e command and the \u003ccode\u003eAmazonS3\u003c/code\u003e class used to implement the experimental \u003ccode\u003eamazons3\u003c/code\u003e git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues."
            }
          ],
          "value": "In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-201",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-201 Serialized Data External Linking"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "USER",
            "Safety": "NEGLIGIBLE",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "GREEN",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "DIFFUSE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:Y/R:U/V:D/RE:L/U:Green",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "LOW"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611 Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-827",
              "description": "CWE-827 Improper Control of Document Type Definition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-14T06:30:04.660Z",
        "orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
        "shortName": "eclipse"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://projects.eclipse.org/projects/technology.jgit/releases/7.2.1"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://projects.eclipse.org/projects/technology.jgit/releases/7.1.1"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://projects.eclipse.org/projects/technology.jgit/releases/7.0.1"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://projects.eclipse.org/projects/technology.jgit/releases/6.10.1"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/64"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://projects.eclipse.org/projects/technology.jgit/releases/5.13.4"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "XXE vulnerability in Eclipse JGit",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
    "assignerShortName": "eclipse",
    "cveId": "CVE-2025-4949",
    "datePublished": "2025-05-21T06:47:19.777Z",
    "dateReserved": "2025-05-19T07:02:22.381Z",
    "dateUpdated": "2025-10-14T06:30:04.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}