XML External Entity Reference in Apache Jena
High severity
GitHub Reviewed
Published
Sep 20, 2021
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Description
Published by the National Vulnerability Database
Sep 16, 2021
Reviewed
Sep 17, 2021
Published to the GitHub Advisory Database
Sep 20, 2021
Last updated
Feb 1, 2023
A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.
References