CVE-2024-34345

Published: May 14, 2024Modified: Nov 21, 2024

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1.

Related CWEs

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (6)

https://github.com/CycloneDX/cyclonedx-javascript-library/commit/5e5e1e0b9422f47d2de81c7c4064b803a01e7203

Source: security-advisories@github.com

https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1063

Source: security-advisories@github.com

https://github.com/CycloneDX/cyclonedx-javascript-library/security/advisories/GHSA-38gf-rh2w-gmj7

Source: security-advisories@github.com

https://github.com/CycloneDX/cyclonedx-javascript-library/commit/5e5e1e0b9422f47d2de81c7c4064b803a01e7203

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1063

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/CycloneDX/cyclonedx-javascript-library/security/advisories/GHSA-38gf-rh2w-gmj7

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.