CVE-2024-38374 - Vulnerability Details - OpenCVE

ReportizFlow

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. This vulnerability has been fixed in cyclonedx-core-java version 9.0.4.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Vendors	Products
Cyclonedx	Cyclonedx Core Java

No data.

No data.

References

Link	Providers
https://github.com/CycloneDX/cyclonedx-core-java/pull/434
https://github.com/CycloneDX/cyclonedx-core-java/pull/434/commits/ab0bc9c530d24f737970dbd0287d1190b129853d
https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8
https://nvd.nist.gov/vuln/detail/CVE-2024-38374
https://www.cve.org/CVERecord?id=CVE-2024-38374

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-06-28T18:01:51.789Z

Updated: 2024-08-02T04:04:25.277Z

Reserved: 2024-06-14T14:16:16.466Z

Link: CVE-2024-38374

Vulnrichment

Updated: 2024-07-01T18:14:37.960Z

NVD

Status : Awaiting Analysis

Published: 2024-06-28T18:15:04.853

Modified: 2024-11-21T09:25:31.790

Link: CVE-2024-38374

Redhat

Severity : Important

Publid Date: 2024-06-28T00:00:00Z

Links: CVE-2024-38374 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-38374", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-06-14T14:16:16.466Z", "datePublished": "2024-06-28T18:01:51.789Z", "dateUpdated": "2024-08-02T04:04:25.277Z"}, "containers": {"cna": {"title": "Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java", "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "lang": "en", "description": "CWE-611: Improper Restriction of XML External Entity Reference", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8"}, {"name": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434", "tags": ["x_refsource_MISC"], "url": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434"}, {"name": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434/commits/ab0bc9c530d24f737970dbd0287d1190b129853d", "tags": ["x_refsource_MISC"], "url": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434/commits/ab0bc9c530d24f737970dbd0287d1190b129853d"}], "affected": [{"vendor": "CycloneDX", "product": "cyclonedx-core-java", "versions": [{"version": ">= 2.1.0, < 9.0.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-28T18:01:51.789Z"}, "descriptions": [{"lang": "en", "value": "The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. This vulnerability has been fixed in cyclonedx-core-java version 9.0.4.\n"}], "source": {"advisory": "GHSA-683x-4444-jxh8", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "cyclonedx", "product": "cyclonedx_core_java", "cpes": ["cpe:2.3:a:cyclonedx:cyclonedx_core_java:2.1.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.1.0", "status": "affected", "lessThan": "9.0.4", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-01T18:05:26.661731Z", "id": "CVE-2024-38374", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-01T18:42:59.045Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:04:25.277Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8"}, {"name": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434"}, {"name": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434/commits/ab0bc9c530d24f737970dbd0287d1190b129853d", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434/commits/ab0bc9c530d24f737970dbd0287d1190b129853d"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38374", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-01T18:05:26.661731Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:cyclonedx:cyclonedx_core_java:2.1.0:*:*:*:*:*:*:*"], "vendor": "cyclonedx", "product": "cyclonedx_core_java", "versions": [{"status": "affected", "version": "2.1.0", "lessThan": "9.0.4", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-01T18:14:37.960Z"}}], "cna": {"title": "Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java", "source": {"advisory": "GHSA-683x-4444-jxh8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "CycloneDX", "product": "cyclonedx-core-java", "versions": [{"status": "affected", "version": ">= 2.1.0, < 9.0.4"}]}], "references": [{"url": "https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8", "name": "https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434", "name": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434/commits/ab0bc9c530d24f737970dbd0287d1190b129853d", "name": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434/commits/ab0bc9c530d24f737970dbd0287d1190b129853d", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. This vulnerability has been fixed in cyclonedx-core-java version 9.0.4.\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-611", "description": "CWE-611: Improper Restriction of XML External Entity Reference"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-28T18:01:51.789Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38374", "state": "PUBLISHED", "dateUpdated": "2024-07-01T18:42:59.045Z", "dateReserved": "2024-06-14T14:16:16.466Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-06-28T18:01:51.789Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. This vulnerability has been fixed in cyclonedx-core-java version 9.0.4.\n"}, {"lang": "es", "value": "El m\u00f3dulo principal de CycloneDX proporciona una representaci\u00f3n modelo del SBOM junto con utilidades para ayudar a crear, validar y analizar SBOM. Antes de deserializar la lista de materiales de CycloneDX en formato XML, _cyclonedx-core-java_ aprovecha las expresiones XPath para determinar la versi\u00f3n del esquema de la lista de materiales. El `DocumentBuilderFactory` utilizado para evaluar expresiones XPath no estaba configurado de forma segura, lo que hac\u00eda que la biblioteca fuera vulnerable a la inyecci\u00f3n de entidad externa XML (XXE). Esta vulnerabilidad se ha solucionado en cyclonedx-core-java versi\u00f3n 9.0.4."}], "id": "CVE-2024-38374", "lastModified": "2024-11-21T09:25:31.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Secondary"}]}, "published": "2024-06-28T18:15:04.853", "references": [{"source": "[email protected]", "url": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434"}, {"source": "[email protected]", "url": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434/commits/ab0bc9c530d24f737970dbd0287d1190b129853d"}, {"source": "[email protected]", "url": "https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/CycloneDX/cyclonedx-core-java/pull/434/commits/ab0bc9c530d24f737970dbd0287d1190b129853d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "[email protected]", "type": "Secondary"}]}

{"bugzilla": {"description": "cyclonedx-core-java: XML External Entity injection while evaluating XPath expressions", "id": "2294737", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294737"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-611", "details": ["The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. This vulnerability has been fixed in cyclonedx-core-java version 9.0.4.", "A flaw was found in cyclonedx-core-java. It is vulnerable to XML External Entity (XXE) injection due to an insecure configuration of the `DocumentBuilderFactory` used to evaluate XPath expressions."], "name": "CVE-2024-38374", "package_state": [{"cpe": "cpe:/a:redhat:migration_toolkit_applications:6", "fix_state": "Will not fix", "package_name": "cyclonedx-core-java", "product_name": "Migration Toolkit for Applications 6"}, {"cpe": "cpe:/a:redhat:migration_toolkit_runtimes:1", "fix_state": "Will not fix", "package_name": "cyclonedx-core-java", "product_name": "Migration Toolkit for Runtimes"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Not affected", "package_name": "cyclonedx-core-java", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Not affected", "package_name": "cyclonedx-core-java", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "cyclonedx-core-java", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Not affected", "package_name": "cyclonedx-core-java", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "cyclonedx-core-java", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:amq_streams:1", "fix_state": "Not affected", "package_name": "cyclonedx-core-java", "product_name": "streams for Apache Kafka"}], "public_date": "2024-06-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-38374\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-38374\nhttps://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8"], "threat_severity": "Important", "upstream_fix": "cyclonedx-core-java 9.0.4"}