CVE-2024-52807

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-52807

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-52807.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-52807

Aliases

GHSA-8c3x-hq82-gjcm

Published

2025-01-24T18:34:23.255Z

Modified

2026-04-10T05:12:21.726654Z

Severity

8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator

Summary

XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`

Details

The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.7.4, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.publisher is being used to within a host where external clients can submit XML. A previous release provided an incomplete solution revealed by new testing. This issue has been patched as of version 1.7.4. No known workarounds are available.

Database specific

{
    "cwe_ids": [
        "CWE-611"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52807.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/hl7/fhir-ig-publisher

Affected ranges

Type: GIT
Repo: https://github.com/hl7/fhir-ig-publisher
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

9a619c4c6cebb3cb3566f079c8f4324dbd05cb90

Affected versions

1.*

1.1.0

1.1.1

1.1.10

1.1.101

1.1.102

1.1.103

1.1.104

1.1.105

1.1.106

1.1.11

1.1.111

1.1.112

1.1.113

1.1.117

1.1.12

1.1.120

1.1.121

1.1.122

1.1.123

1.1.124

1.1.125

1.1.126

1.1.127

1.1.128

1.1.129

1.1.13

1.1.14

1.1.15

1.1.16

1.1.17

1.1.18

1.1.2

1.1.3

1.1.33

1.1.37

1.1.38

1.1.39

1.1.4

1.1.40

1.1.41

1.1.42

1.1.43

1.1.44

1.1.45

1.1.5

1.1.50

1.1.51

1.1.53

1.1.54

1.1.55

1.1.56

1.1.57

1.1.59

1.1.6

1.1.60

1.1.61

1.1.62

1.1.63

1.1.64

1.1.66

1.1.67

1.1.68

1.1.7

1.1.71

1.1.72

1.1.73

1.1.74

1.1.75

1.1.76

1.1.77

1.1.78

1.1.79

1.1.8

1.1.81

1.1.82

1.1.83

1.1.84

1.1.85

1.1.86

1.1.88

1.1.90

1.1.91

1.1.92

1.1.93

1.1.94

1.1.95

1.1.96

1.1.97

1.1.98

1.1.99

1.2.0

1.2.1

1.2.12

1.2.13

1.2.14

1.2.15

1.2.18

1.2.2

1.2.20

1.2.21

1.2.23

1.2.24

1.2.28

1.2.29

1.2.3

1.2.30

1.2.31

1.2.32

1.2.33

1.2.34

1.2.35

1.2.36

1.2.37

1.2.38

1.2.4

1.2.40

1.2.41

1.2.42

1.2.45

1.2.46

1.2.47

1.2.49

1.2.5

1.2.50

1.2.51

1.2.52

1.2.6

1.2.7

1.3.11

1.3.12

1.3.13

1.3.15

1.3.16

1.3.17

1.3.19

1.3.2

1.3.20

1.3.22

1.3.23

1.3.24

1.3.3

1.3.5

1.3.6

1.3.7

1.3.8

1.4.0

1.4.1

1.4.10

1.4.11

1.4.12

1.4.13

1.4.15

1.4.16

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

1.5.0

1.5.13

1.5.14

1.5.15

1.5.16

1.5.2

1.5.3

1.5.4

1.5.5

1.5.9

1.6.0

1.6.1

1.6.10

1.6.11

1.6.12

1.6.13

1.6.14

1.6.15

1.6.16

1.6.17

1.6.18

1.6.19

1.6.20

1.6.23

1.6.25

1.6.26

1.6.28

1.6.29

1.6.30

1.6.31

1.6.4

1.6.7

1.6.8

1.6.9

1.7.0

1.7.1

1.7.2

1.7.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-52807.json"