Threats affecting pkg:maven/org.eclipse.digitaltwin/aas4j

Eclipse AAS Model for Java (Eclipse AAS4J) versions before 3.0.1 contain a vulnerability in XML schema validation where external DTDs and entities are resolved by default. This allows an attacker to supply crafted XML or AASX packages that can read local files and exfiltrate their contents, as well as cause outbound requests (SSRF) without validation errors. The issue is fixed in version 3.0.1 by disabling external entity resolution and rejecting DOCTYPE declarations.