XML External Entity Reference in drools

CRITIQUE 9.8CVE-2021-41411 · GHSA-rc57-9r3x-98cq · Published 16/06/2022 · updated 17/06/2026

En bref

CVE-2021-41411 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant org.drools:drools-core, drools (redhat).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.3%, plus élevée que 70.1% des vulnérabilités.
Correctif : mettre à jour vers 7.60.0.Final, 7.6.0 ou plus récent.

Package	Affected versions	Patched versions
org.drools:drools-core Maven	`< 7.60.0.Final`	`7.60.0.Final`
drools redhat	`< 7.6.0`	`7.6.0`

Description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

NVD description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2021-41411 · ADVISORY
apache/incubator-kie-drools#3808 · WEB
kiegroup/drools · PACKAGE
kiegroup/drools#3808 · Patch

Autres vulnérabilités de org.drools:drools-core

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.drools:drools-core

Maven

< 7.60.0.Final

7.60.0.Final

drools

redhat

< 7.6.0

7.6.0

Description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

NVD description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

Autres vulnérabilités de org.drools:drools-core

Tout voir →