fkie_cve-2024-45294
Vulnerability from fkie_nvd
Published
2024-09-06 16:15
Modified
2024-09-06 17:15
Severity ?
Summary
The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification. Prior to version 6.3.23, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This issue has been patched in release 6.3.23. No known workarounds are available.
References
Impacted products
Vendor | Product | Version |
---|
{ cveTags: [], descriptions: [ { lang: "en", value: "The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification. Prior to version 6.3.23, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This issue has been patched in release 6.3.23. No known workarounds are available.", }, { lang: "es", value: "El repositorio HL7 FHIR Core Artifacts proporciona el código de manejo de objetos básicos de Java, con utilidades (incluido el validador), para la especificación de recursos de interoperabilidad rápida de atención médica (FHIR). Antes de la versión 6.3.23, las transformaciones XSLT realizadas por varios componentes son vulnerables a las inyecciones de entidades externas de XML. Un archivo XML procesado con una etiqueta DTD maliciosa podría producir XML que contenga datos del sistema host. Esto afecta los casos de uso en los que se utiliza org.hl7.fhir.core dentro de un host donde los clientes externos pueden enviar XML. Este problema se ha corregido en la versión 6.3.23. No hay workarounds disponibles.", }, ], id: "CVE-2024-45294", lastModified: "2024-09-06T17:15:16.977", metrics: { cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 8.6, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 4, source: "security-advisories@github.com", type: "Secondary", }, ], }, published: "2024-09-06T16:15:03.300", references: [ { source: "security-advisories@github.com", url: "https://github.com/HL7/fhir-ig-publisher/releases/tag/1.6.22", }, { source: "security-advisories@github.com", url: "https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-59rq-22fm-x8q5", }, { source: "security-advisories@github.com", url: "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.3.23", }, { source: "security-advisories@github.com", url: "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf", }, ], sourceIdentifier: "security-advisories@github.com", vulnStatus: "Awaiting Analysis", weaknesses: [ { description: [ { lang: "en", value: "CWE-611", }, ], source: "security-advisories@github.com", type: "Secondary", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.