medium
CVE-2023-45960
Withdrawn Advisory: dom4j XML Entity Expansion vulnerability
Impact
## Withdrawn Advisory This advisory has been withdrawn because [the underlying vulnerability could not be reproduced](https://github.com/joker-xiaoyan/XXE-SAXReader/issues/1#issuecomment-1783780581). This link is maintained to preserve external references. ## Original Description An issue in dom4.j org.dom4.io.SAXReader v.2.1.4 and before allows a remote attacker to obtain sensitive information via the setFeature function.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.dom4j:dom4j | <= 2.1.4 | none recorded |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-fgq9-fc3q-vqmw
- https://nvd.nist.gov/vuln/detail/CVE-2023-45960
- https://dom4j.github.io/
- https://github.com/joker-xiaoyan/XXE-SAXReader/blob/8c0d24f9800c36c8ad36457c1df1e4aaff24c7b9/POC.java
- https://github.com/dom4j/dom4j/issues/171#issuecomment-1781547256
- https://github.com/joker-xiaoyan/XXE-SAXReader/issues/1
- https://github.com/joker-xiaoyan/XXE-SAXReader/tree/main