GHSA-gchv-364h-r896CriticalCVSS 9.8

XML External Entity Reference in apache jena

Published
May 6, 2022
Last Modified
October 13, 2023

🔗 CVE IDs covered (1)

CVE-2022-28890 →

📋 Description

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 only. Apache Jena 4.2.x and 4.3.x do not allow external entities.

🎯 Affected products1

  • maven/org.apache.jena:jena:= 4.4.0

🔗 References (4)