ClassGraph XML External Entity Reference · CVE-2021-47621 · GitHub Advisory Database · GitHub

ClassGraph XML External Entity Reference

Moderate severity GitHub Reviewed Published Jun 21, 2024 to the GitHub Advisory Database • Updated Jun 21, 2024

Package

io.github.classgraph:classgraph (Maven)

Affected versions

< 4.8.112

Patched versions

4.8.112

Description

ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.

References

Published by the National Vulnerability Database

Jun 21, 2024

Published to the GitHub Advisory Database Jun 21, 2024

Reviewed Jun 21, 2024

Last updated Jun 21, 2024

Severity

Moderate

6.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N