PT-2025-2936 · Hl7 · Hl7 Fhir Ig Publisher

Dotasek · Published 2025-01-24 · Updated 2026-01-29 · CVE-2024-52807

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HL7 FHIR IG Publisher versions prior to 1.7.4

Description The HL7 FHIR IG publisher tool, used to create standard FHIR IGs, has an issue where XSLT transforms performed by its components are susceptible to XML external entity injections. A specially crafted XML file containing a malicious DTD tag ( ]> could potentially expose data from the host system. This is particularly relevant in scenarios where the org.hl7.fhir.publisher is used in an environment where external clients can submit XML files. A prior attempt to address this issue was found to be incomplete through further testing.

Recommendations Versions prior to 1.7.4 should be updated to version 1.7.4 to resolve this issue.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-52807

GHSA-8C3X-HQ82-GJCM

Affected Products

Hl7 Fhir Ig Publisher

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52807.json · Exploit
• https://osv.dev/vulnerability/GHSA-8c3x-hq82-gjcm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52807 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52807 · Vendor Advisory
• https://github.com/HL7/fhir-ig-publisher/compare/1.7.3...1.7.4 · Note
• https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-8c3x-hq82-gjcm · Note
• https://github.com/HL7/fhir-ig-publisher/commit/3560de2f486d688a3ddcf4aa54d8bdacea380c3d · Note
• https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-59rq-22fm-x8q5 · Note
• https://github.com/HL7/fhir-ig-publisher · Note
• https://t.me/cveNotify/150219 · Telegram Post
• https://t.me/cvedetector/16340 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1882917264514502758 · Twitter Post
• https://twitter.com/CVEnew/status/1882861745812930670 · Twitter Post
• https://twitter.com/CveFindCom/status/1882866345684963497 · Twitter Post