| Package | Affected versions | Patched versions |
|---|---|---|
| org.jdom:jdom | ≤ 2.0.2 | |
| org.jdom:jdom2 | < 2.0.6.1 | 2.0.6.1 |
| solr | = 8.8.1= 8.9 | |
| tika | = 1.25 | |
| jdom | ≤ 2.0.6 |
An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. As a workaround, to avoid external entities being expanded, one can call builder.setExpandEntities(false) and they won't be expanded.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free