GHSA-fgq9-fc3q-vqmw

Source

https://github.com/advisories/GHSA-fgq9-fc3q-vqmw

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-fgq9-fc3q-vqmw/GHSA-fgq9-fc3q-vqmw.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fgq9-fc3q-vqmw

Aliases

CVE-2023-45960

Withdrawn

2023-10-31T20:21:23Z

Published

2023-10-25T18:32:23Z

Modified

2026-09-10T03:50:03Z

Summary

Withdrawn Advisory: dom4j XML Entity Expansion vulnerability

Details

Withdrawn Advisory

This advisory has been withdrawn because the underlying vulnerability could not be reproduced. This link is maintained to preserve external references.

Original Description

An issue in dom4.j org.dom4.io.SAXReader v.2.1.4 and before allows a remote attacker to obtain sensitive information via the setFeature function.

Database specific

{
    "cwe_ids":  [
        "CWE-776"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-10-27T19:50:41Z",
    "nvd_published_at":  "2023-10-25T18:17:35Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / org.dom4j:dom4j

Package

Name: org.dom4j:dom4j; View open source insights on deps.dev
Purl: pkg:maven/org.dom4j/dom4j

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

2.1.4

Affected versions

2.*

2.0.0-RC1

2.0.0

2.0.1

2.0.2

2.0.3

2.1.0

2.1.1

2.1.3

2.1.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-fgq9-fc3q-vqmw/GHSA-fgq9-fc3q-vqmw.json"