Sensitive information sent insecurely In com.thoughtworks.xstream:xstream
Description
XML External Entity Injection in XStream Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 maven | 1.4.9 | ||
 debian 13 | 1.4.9-1 | ||
debian 11 | 1.4.9-1 | ||
debian 12 | 1.4.9-1 | ||
debian 14 | 1.4.9-1 | ||
 rpm rhel7 | - | - |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11.