Vulnerability · Published May 9, 2024 · Assigned by GitHub_M
CVE-2024-34345@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability
High 8.1
In plain English
A high-severity XML external entity in cyclonedx-javascript-library from CycloneDX. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.9%top 39.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @cyclonedx/cyclonedx-library | 6.7.1 | GHSA-38gf-rh2w-gmj7 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CycloneDX | cyclonedx-javascript-library | = 6.7.0 |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/CycloneDX/cyclonedx-javascript-library/security/advisories/GHSA-38gf-rh2w-gmj7 x_refsource_CONFIRM
- https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1063 x_refsource_MISC
- https://github.com/CycloneDX/cyclonedx-javascript-library/commit/5e5e1e0b9422f47d2de81c7c4064b803a01e7203 x_refsource_MISC