GHSA-v62g-jwj9-rfvxHighCVSS 8.8

XML External Entity Reference (XXE) in the XML Format Plugin in Apache Drill

Published
July 24, 2024
Last Modified
September 10, 2024

🔗 CVE IDs covered (1)

CVE-2023-48362 →

📋 Description

XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue.

🎯 Affected products1

  • maven/org.apache.drill.exec:drill-java-exec:>= 1.19.0, < 1.21.2

🔗 References (6)