XML External Entity Reference in drools

CRÍTICO 9.8CVE-2021-41411 · GHSA-rc57-9r3x-98cq · Published 16/06/2022 · updated 17/06/2026

En resumen

CVE-2021-41411 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a org.drools:drools-core, drools (redhat).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.3%, mayor que el 70.1% de las vulnerabilidades.
Solución: actualizar a 7.60.0.Final, 7.6.0 o posterior.

Package	Affected versions	Patched versions
org.drools:drools-core Maven	`< 7.60.0.Final`	`7.60.0.Final`
drools redhat	`< 7.6.0`	`7.6.0`

Description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

NVD description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2021-41411 · ADVISORY
apache/incubator-kie-drools#3808 · WEB
kiegroup/drools · PACKAGE
kiegroup/drools#3808 · Patch

Más vulnerabilidades de org.drools:drools-core

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.drools:drools-core

Maven

< 7.60.0.Final

7.60.0.Final

drools

redhat

< 7.6.0

7.6.0

Description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

NVD description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

Más vulnerabilidades de org.drools:drools-core

Ver todo →