critical9.8
CVE-2021-41411
XML External Entity Reference in drools
Impact
drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.drools:drools-core | <= 7.59.0.Final | 7.60.0.Final |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Drools | before 7.6.0 |