XML External Entity Reference in drools

CRITICO 9.8CVE-2021-41411 · GHSA-rc57-9r3x-98cq · Published 16/06/2022 · updated 17/06/2026

In breve

CVE-2021-41411 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda org.drools:drools-core, drools (redhat).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.3%, superiore al 70.1% delle vulnerabilità.
Correzione: aggiornare a 7.60.0.Final, 7.6.0 o successiva.

Package	Affected versions	Patched versions
org.drools:drools-core Maven	`< 7.60.0.Final`	`7.60.0.Final`
drools redhat	`< 7.6.0`	`7.6.0`

Description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

NVD description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2021-41411 · ADVISORY
apache/incubator-kie-drools#3808 · WEB
kiegroup/drools · PACKAGE
kiegroup/drools#3808 · Patch

Altre vulnerabilità di org.drools:drools-core

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.drools:drools-core

Maven

< 7.60.0.Final

7.60.0.Final

drools

redhat

< 7.6.0

7.6.0

Description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

NVD description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

Altre vulnerabilità di org.drools:drools-core

Vedi tutto →