GHSA-v723-58jv-2qc4Medium

Exposure of Sensitive Information to an Unauthorized Actor in OpenSAML

Published
May 13, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2013-6440 →

📋 Description

The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.

🎯 Affected products1

  • maven/org.opensaml:opensaml:< 2.6.1

🔗 References (10)