CVE-2024-58335 | THREATINT

Description

OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualization/VisualizerImpl.java.

PUBLISHED Reserved 2025-12-24 | Published 2025-12-24 | Updated 2025-12-24 | Assigner mitre

MEDIUM: 5.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Problem types

CWE-611 Improper Restriction of XML External Entity Reference

Product status

Default status

unaffected

Any version before 6c50e8979924b09f336c976cbad3a9ebfe25ebf9

affected

References

github.com/...ommit/6c50e8979924b09f336c976cbad3a9ebfe25ebf9

invoice.secvuln.info

cve.org (CVE-2024-58335)

nvd.nist.gov (CVE-2024-58335)

Download JSON