PT-2024-22312 · Apache+2 · Apache Xml Graphics+2

C1Gar · Published 2024-10-09 · Updated 2025-07-16 · CVE-2024-28168

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache XML Graphics FOP version 2.9

Description The issue is related to an Improper Restriction of XML External Entity Reference, also known as an XXE vulnerability, in Apache XML Graphics FOP. This vulnerability is due to the improper restriction of XML External Entity references.

Recommendations For Apache XML Graphics FOP version 2.9, upgrade to version 2.10, which fixes the issue.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2025-06619

CVE-2024-28168

GHSA-JQFV-JRVQ-95JM

OESA-2024-2243

OPENSUSE-SU-2024:14398-1

OPENSUSE-SU-2024_4054-1

SUSE-SU-2024:4054-1

SUSE-SU-2024_4054-1

Affected Products

Apache Xml Graphics

Debian

Suse

References · 31

• https://osv.dev/vulnerability/CVE-2024-28168 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06619 · Security Note
• https://osv.dev/vulnerability/OESA-2024-2243 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14398-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:4054-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-28168 · Vendor Advisory
• https://xmlgraphics.apache.org/security.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-28168 · Security Note
• https://ubuntu.com/security/CVE-2024-28168 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-28168 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28168 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-28168 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jqfv-jrvq-95jm · Vendor Advisory
• https://github.com/apache/xmlgraphics-fop · Note
• https://github.com/apache/xmlgraphics-fop/commit/d96ba9a11710d02716b6f4f6107ebfa9ccec7134 · Note