CVE-2024-52007XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`
Updated under an hour ago ()
Does this affect you?
It affects hapifhir org.hl7.fhir.core and 1 other product. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.90%, higher than 59% of scored CVEs.
Do this next
Free account, 1 product
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This is related to GHSA-6cr6-ph3p-f5rf, in which its fix (#1571 & #1717) was incomplete. This issue has been addressed in release version 6.4.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- CVSS
- 8.6 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- Weakness (CWE)
- CWE-611
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.90% (percentile 59)
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- Nov 12, 2024
- First seen by InfoSec Signals
- Oct 12, 2026
Affected products
hapifhir org.hl7.fhir.core hapifhir:org.hl7.fhir.core (from the name) | before 6.4.0 | CNA record |
hapifhir hl7_fhir_core hapifhir:hl7_fhir_core | before 6.4.0 | CISA ADP |
References
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-gr3c-q7xf-47vhx-refsource-confirm
- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rfx-refsource-misc
- https://github.com/hapifhir/org.hl7.fhir.core/issues/1571x-refsource-misc
- https://github.com/hapifhir/org.hl7.fhir.core/pull/1717x-refsource-misc
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4jx-refsource-misc
- https://cwe.mitre.org/data/definitions/611.htmlx-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.