GHSA-hfj4-xq5f-7mc7

GHSA-hfj4-xq5f-7mc7 PUBLISHED CVSS 8.199999809265137 HIGH

Record from GitHub Advisory Database · Published August 11, 2022

XML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Here, XML external entity injection lead to External Service interaction & Internal file read in Business Central and also Kie-Server APIs.

Risk scores

CVSS 3.1

8.199999809265137

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Timeline

Aug 11, 2022 CVE Published
May 1, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-hfj4-xq5f-7mc7
vulnetix vdb fixes GHSA-hfj4-xq5f-7mc7

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-hfj4-xq5f-7mc7/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →