XML External Entity Reference in drools

CRÍTICO 9.8CVE-2021-41411 · GHSA-rc57-9r3x-98cq · Published 16/06/2022 · updated 17/06/2026

Em resumo

CVE-2021-41411 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta org.drools:drools-core, drools (redhat).
Chance de exploração nos próximos 30 dias (EPSS): 1.3%, maior que 70.1% das vulnerabilidades.
Correção: atualize para 7.60.0.Final, 7.6.0 ou posterior.

Package	Affected versions	Patched versions
org.drools:drools-core Maven	`< 7.60.0.Final`	`7.60.0.Final`
drools redhat	`< 7.6.0`	`7.6.0`

Description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

NVD description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2021-41411 · ADVISORY
apache/incubator-kie-drools#3808 · WEB
kiegroup/drools · PACKAGE
kiegroup/drools#3808 · Patch

Mais vulnerabilidades de org.drools:drools-core

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.drools:drools-core

Maven

< 7.60.0.Final

7.60.0.Final

drools

redhat

< 7.6.0

7.6.0

Description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

NVD description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

Mais vulnerabilidades de org.drools:drools-core

Ver tudo →