XXE via XML External Entity in HuTool XML Parsing Module (<5.8.19)
CVE-2023-3276 Published on June 15, 2023
Dromara HuTool XML Parsing Module XmlUtil.java readBySax xml external entity reference
A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclosed to the public and may be used. VDB-231626 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Timeline
Advisory disclosed
CVE reserved
VulDB entry created
VulDB entry last update 29 days later.
Weakness Type
What is a XXE Vulnerability?
The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVE-2023-3276 has been classified to as a XXE vulnerability or weakness.
Products Associated with CVE-2023-3276
Want to know whenever a new CVE is published for Dromara Hutool? stack.watch will email you.
Affected Versions
Dromara HuTool:- Version 5.8.0 is affected.
- Version 5.8.1 is affected.
- Version 5.8.2 is affected.
- Version 5.8.3 is affected.
- Version 5.8.4 is affected.
- Version 5.8.5 is affected.
- Version 5.8.6 is affected.
- Version 5.8.7 is affected.
- Version 5.8.8 is affected.
- Version 5.8.9 is affected.
- Version 5.8.10 is affected.
- Version 5.8.11 is affected.
- Version 5.8.12 is affected.
- Version 5.8.13 is affected.
- Version 5.8.14 is affected.
- Version 5.8.15 is affected.
- Version 5.8.16 is affected.
- Version 5.8.17 is affected.
- Version 5.8.18 is affected.
- Version 5.8.19 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.