CVE-2024-28168

Published: Oct 9, 2024Modified: Jul 16, 2025

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue.

Affected (1)

Products: Apache: Formatting Objects Processor

Apache

1 product

Formatting Objects Processor

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Formatting Objects Processor	Version 2.9

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

https://xmlgraphics.apache.org/security.html

Source: security@apache.org

Vendor Advisory

http://www.openwall.com/lists/oss-security/2024/10/09/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.