Description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

Remediation

References

https://github.com/kiegroup/drools/pull/3808

Related Vulnerabilities

CVE-2020-28272 Vulnerability in npm package keyget

CVE-2015-7559 Vulnerability in maven package org.apache.activemq:activemq-all

CVE-2018-20676 Vulnerability in maven package org.webjars.bowergithub.angular-ui:bootstrap

CVE-2021-22119 Vulnerability in maven package org.springframework.security:spring-security-oauth2-client

CVE-2021-46708 Vulnerability in maven package org.webjars:swagger-ui

Severity

Critical

Classification

CWE-611 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory