Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ucum-java has an XXE vulnerability in XML parsing
Vulnerability Description
Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML. Release 1.0.9 of Ucum-java fixes this vulnerability. As a workaround, ensure that the source xml for instantiating UcumEssenceService is trusted.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Vulnerability Title
Ucum-java 代码问题漏洞
Vulnerability Description
Ucum-java是FHIR开源的一个提供 Ucum 服务的 FHIR Java 库。 Ucum-java 1.0.9之前版本存在代码问题漏洞，该漏洞源于UcumEssenceService执行的XML解析容易受到XML外部实体注入的攻击，导致外部客户端可以提交XML。
CVSS Information
N/A
Vulnerability Type
N/A