CVE-2024-51132

An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.

Score

CVSS 3.1 9.8 Critical

Status

Deferred - cve@mitre.org

Published

2024-11-05

Last modified

2024-11-06

Weaknesses

CWE-611

Affected products

• Hapi Fhir (Fhir)

References

• https://github.com/JAckLosingHeart/CVE-2024-51132-POC
• https://github.com/hapifhir/org.hl7.fhir.core