CVE-2024-34345

@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability

State: Published
Severity: 8.1 High
Published: May 9, 2024
Updated: Aug 2, 2024
Reserved: May 2, 2024

Description

The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-611 Improper Restriction of XML External Entity Reference

Affected Products

Product	Versions
cyclonedx-javascript-libraryCycloneDX	= 6.7.0Affected

References

https://github.com/CycloneDX/cyclonedx-javascript-library/security/advisories/GHSA-38gf-rh2w-gmj7
https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1063
https://github.com/CycloneDX/cyclonedx-javascript-library/commit/5e5e1e0b9422f47d2de81c7c4064b803a01e7203

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.