Code Injection in xmlunit - CVE-2024-31573

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU94755

Code Injection in xmlunit - CVE-2024-31573

Published: July 26, 2024


Vulnerability identifier: #VU94755
CSH Severity: Medium
CVSS v4 BT: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-31573
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to XMLUnit for Java does not disable XSLT extension functions by default when performing XSLT transformations. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.


Affected software

xmlunit
Cloud Pak for Network Automation
Maximo Application Suite - Monitor Component
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
Oracle SOA Suite
openEuler
xmlunit-placeholders
xmlunit-matchers
xmlunit-legacy
xmlunit-core
xmlunit-assertj
xmlunit
IBM App Connect Enterprise

How to mitigate CVE-2024-31573

Install updates from vendor's website.

xmlunit - update to 2.10.0
Cloud Pak for Network Automation - update to 2.7.4
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
xmlunit-placeholders - addressed in versions 2.7.0-2, 2.7.0-3
xmlunit-matchers - addressed in versions 2.7.0-2, 2.7.0-3
xmlunit-legacy - addressed in versions 2.7.0-2, 2.7.0-3
xmlunit-core - addressed in versions 2.7.0-2, 2.7.0-3
xmlunit-assertj - addressed in versions 2.7.0-2, 2.7.0-3
xmlunit - addressed in versions 2.7.0-2, 2.7.0-3
IBM Watson Assistant for IBM Cloud Pak for Data - update to 5.0.3
Maximo Application Suite - Monitor Component - addressed in versions 8.10.13, 8.11.10, 9.0.2
IBM App Connect Enterprise - update to 12.0.12.3

External References

Related Security Bulletins