XML external entity (XXE) injection in Apache Nutch
Critical severity
GitHub Reviewed
Published
Mar 18, 2022
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Description
Published by the National Vulnerability Database
Jan 25, 2021
Reviewed
Apr 6, 2021
Published to the GitHub Advisory Database
Mar 18, 2022
Last updated
Feb 1, 2023
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Nutch 1.18.
References