漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
http4k has a potential XXE (XML External Entity Injection) vulnerability
Vulnerability Description
http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 5.41.0.0, there is a potential XXE (XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server, trigger Server-side Request Forgery and even execute code under some circumstances. Version 5.41.0.0 contains a patch for the issue.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
信息暴露
Vulnerability Title
http4k 代码问题漏洞
Vulnerability Description
http4k是http4k开源的一个轻量级但功能齐全的 HTTP 工具包。 http4k 5.41.0.0之前版本存在代码问题漏洞，该漏洞源于在处理请求中的恶意XML内容时存在潜在的XML外部实体注入漏洞，可能允许攻击者读取服务器上的本地敏感信息，触发服务器端请求伪造，甚至在某些情况下执行代码。
CVSS Information
N/A
Vulnerability Type
N/A