GHSA-6qx9-rf9g-7jmrHigh

Improper Input Validation in Drools and jBPM

Published
May 17, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2014-8125 →

📋 Description

XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

🎯 Affected products2

  • maven/org.drools:drools-core:<= 6.2.0.CR4
  • maven/org.jbpm:jbpm-bpmn2:<= 6.2.0.CR4

🔗 References (7)