Description
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.
Remediation
References
https://issues.apache.org/jira/browse/XMLBEANS-517
https://poi.apache.org/
https://security.netapp.com/advisory/ntap-20210513-0004/
https://lists.debian.org/debian-lts-announce/2021/06/msg00024.html
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/security-alerts/cpujul2022.html
https://lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed%40%3Cjava-dev.axis.apache.org%3E
https://lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1%40%3Cjava-dev.axis.apache.org%3E
Related Vulnerabilities
CVE-2022-4137 Vulnerability in maven package org.keycloak:keycloak-services
CVE-2020-9480 Vulnerability in maven package org.apache.spark:spark-network-common_2.12
CVE-2023-30542 Vulnerability in npm package @openzeppelin/contracts-upgradeable
CVE-2023-3414 Vulnerability in maven package io.jenkins.plugins:servicenow-devops