HAPI FHIR XML External Entity (XXE) vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-51132 · ADVISORY
• hapifhir/org.hl7.fhir.core commit 7ede053 · WEB
• JAckLosingHeart/CVE-2024-51132-POC · WEB
• hapifhir/org.hl7.fhir.core · PACKAGE

More vulnerabilities in ca.uhn.hapi.fhir:org.hl7.fhir.convertors

• CVE-2026-55470HIGH 7.5HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-20…
• CVE-2026-33180HIGH 7.5HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when settin…
• CVE-2023-28465HIGH 7.5The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to cer…
• CVE-2023-24057HIGH 8.1HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal f…