CVE-2024-45294
HIGH8.6EPSS 0.09%XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`
Description
### Impact XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( `<!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]>` could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. ### Patches This issue has been patched in release 6.3.23 ### Workarounds None. ### References [MITRE CWE](https://cwe.mitre.org/data/definitions/611.html) [OWASP XML External Entity Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#transformerfactory)
Affected packages (6)
- Maven/ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016mayfrom 0, < 6.3.23
- Maven/ca.uhn.hapi.fhir:org.hl7.fhir.dstu3from 0, < 6.3.23
- Maven/ca.uhn.hapi.fhir:org.hl7.fhir.r4from 0, < 6.3.23
- Maven/ca.uhn.hapi.fhir:org.hl7.fhir.r4bfrom 0, < 6.3.23
- Maven/ca.uhn.hapi.fhir:org.hl7.fhir.r5from 0, < 6.3.23
- Maven/ca.uhn.hapi.fhir:org.hl7.fhir.utilitiesfrom 0, < 6.3.23
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
| osv | CVSS 3.1 | HIGH8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
References (6)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-45294
- PATCHhttps://github.com/hapifhir/org.hl7.fhir.core
- WEBhttps://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.3.23
- WEBhttps://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf
- WEBhttps://github.com/HL7/fhir-ig-publisher/releases/tag/1.6.22
- WEBhttps://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-59rq-22fm-x8q5