high7.5
CVE-2024-28168
Apache XML Graphics FOP XML External Entity Reference ('XXE') vulnerability
Impact
Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.xmlgraphics:fop-core | <= 2.9 | 2.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Formatting Objects Processor | Version 2.9 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://xmlgraphics.apache.org/security.html
- http://www.openwall.com/lists/oss-security/2024/10/09/1
- https://github.com/advisories/GHSA-jqfv-jrvq-95jm
- https://nvd.nist.gov/vuln/detail/CVE-2024-28168
- https://github.com/apache/xmlgraphics-fop/commit/d96ba9a11710d02716b6f4f6107ebfa9ccec7134
- https://issues.apache.org/jira/browse/FOP-3168