PT-2023-29776 · Org.Dom4J · Org.Dom4J

Published 2023-10-24 · Updated 2023-11-22 · CVE-2023-45960

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions org.dom4j SAXReader versions 2.1.4 and before

Description The issue allows a remote attacker to obtain sensitive information via the setFeature function. However, it's noted that the underlying vulnerability could not be reproduced.

Recommendations For org.dom4j SAXReader versions 2.1.4 and before, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XML Entity Expansion

Weakness Enumeration

CWE-776

Related Identifiers

CVE-2023-45960

GHSA-FGQ9-FC3Q-VQMW

Affected Products

Org.Dom4J

References · 12

• 🔥 https://github.com/joker-xiaoyan/XXE-SAXReader/blob/8c0d24f9800c36c8ad36457c1df1e4aaff24c7b9/POC.java · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-45960 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fgq9-fc3q-vqmw · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-45960 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-45960 · Security Note
• https://ubuntu.com/security/CVE-2023-45960 · Vendor Advisory
• https://github.com/dom4j/dom4j · Note
• https://github.com/dom4j/dom4j/issues/171#issuecomment-1781547256 · Note
• https://twitter.com/CVEnew/status/1716781183810380261 · Twitter Post
• https://dom4j.github.io · Note
• https://github.com/joker-xiaoyan/XXE-SAXReader/issues/1 · Note
• https://github.com/joker-xiaoyan/XXE-SAXReader/tree/main · Note