FKIE_CVE-2024-45294

Vulnerability from fkie_nvd - Published: 2024-09-06 16:15 - Updated: 2024-09-06 17:15
Severity ?
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Summary
The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification. Prior to version 6.3.23, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This issue has been patched in release 6.3.23. No known workarounds are available.
References
security-advisories@github.comhttps://github.com/HL7/fhir-ig-publisher/releases/tag/1.6.22
security-advisories@github.comhttps://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-59rq-22fm-x8q5
security-advisories@github.comhttps://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.3.23
security-advisories@github.comhttps://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification. Prior to version 6.3.23, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This issue has been patched in release 6.3.23. No known workarounds are available."
    },
    {
      "lang": "es",
      "value": "El repositorio HL7 FHIR Core Artifacts proporciona el c\u00f3digo de manejo de objetos b\u00e1sicos de Java, con utilidades (incluido el validador), para la especificaci\u00f3n de recursos de interoperabilidad r\u00e1pida de atenci\u00f3n m\u00e9dica (FHIR). Antes de la versi\u00f3n 6.3.23, las transformaciones XSLT realizadas por varios componentes son vulnerables a las inyecciones de entidades externas de XML. Un archivo XML procesado con una etiqueta DTD maliciosa podr\u00eda producir XML que contenga datos del sistema host. Esto afecta los casos de uso en los que se utiliza org.hl7.fhir.core dentro de un host donde los clientes externos pueden enviar XML. Este problema se ha corregido en la versi\u00f3n 6.3.23. No hay workarounds disponibles."
    }
  ],
  "id": "CVE-2024-45294",
  "lastModified": "2024-09-06T17:15:16.977",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-09-06T16:15:03.300",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/HL7/fhir-ig-publisher/releases/tag/1.6.22"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-59rq-22fm-x8q5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.3.23"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.