Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection
Vulnerability Description
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Vulnerability Title
CycloneDX Core 代码问题漏洞
Vulnerability Description
CycloneDX Core是CycloneDX BOM Standard开源的一个辅助创建SBOM应用程序的软件。 CycloneDX Core 11.0.1之前版本存在代码问题漏洞，该漏洞源于XML Validator未安全配置，可能导致XML外部实体注入攻击。
CVSS Information
N/A
Vulnerability Type
N/A