Threats tagged 'ghsa-6fhj-vr9j-g45r'

CycloneDX Core Java versions from 2.1.0 up to but not including 11.0.1 contain a vulnerability in the XML Validator configuration that allows XML External Entity (XXE) injection. This vulnerability stems from incomplete fixes that addressed XML parsing but not validation. The issue is resolved in version 11.0.1. The vulnerability has a high severity with a CVSS score of 7.5 and can lead to high confidentiality impact without affecting integrity or availability.