Apache XML Graphics FOP XML External Entity Reference ('XXE') vulnerability

ALTO 7.5CVE-2024-28168 · GHSA-jqfv-jrvq-95jm · Published 09/10/2024 · updated 17/06/2026

Em resumo

CVE-2024-28168 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta org.apache.xmlgraphics:fop-core, formatting objects processor (apache).
Chance de exploração nos próximos 30 dias (EPSS): 1.0%, maior que 64.1% das vulnerabilidades.
Correção: atualize para 2.10 ou posterior.

Package	Affected versions	Patched versions
org.apache.xmlgraphics:fop-core Maven	`< 2.10`	`2.10`
formatting objects processor apache	`= 2.9`	No fix yet

Description

Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.

This issue affects Apache XML Graphics FOP: 2.9.

Users are recommended to upgrade to version 2.10, which fixes the issue.

NVD description

Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2024-28168 · ADVISORY
apache/xmlgraphics-fop commit d96ba9a · WEB
apache/xmlgraphics-fop · PACKAGE
issues.apache.org/jira/browse/FOP-3168 · WEB
xmlgraphics.apache.org/security.html · WEB
openwall.com/lists/oss-security/2024/10/09/1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free