CVE-2024-38374
CVSS V2 None
CVSS V3 None
Description
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. This vulnerability has been fixed in cyclonedx-core-java version 9.0.4.
Overview
- CVE ID
- CVE-2024-38374
- Assigner
- GitHub_M
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-06-28T18:01:51.789Z
- Last Modified Date
- 2024-06-28T18:01:51.789Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8 | x_refsource_CONFIRM |
| https://github.com/CycloneDX/cyclonedx-core-java/pull/434 | x_refsource_MISC |
| https://github.com/CycloneDX/cyclonedx-core-java/pull/434/commits/ab0bc9c530d24f737970dbd0287d1190b129853d | x_refsource_MISC |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2024-38374 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38374 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-06-29 13:12:00 | Added to TrackCVE |