CVE-2024-45294

{"id": "CVE-2024-45294", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-45294", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-06T16:15:37.499709Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "hapifhir", "product": "org.hl7.fhir.core", "versions": [{"status": "affected", "version": "< 6.3.23"}]}]}], "published": "2024-09-06T16:15:03.300", "references": [{"url": "https://github.com/HL7/fhir-ig-publisher/releases/tag/1.6.22", "source": "security-advisories@github.com"}, {"url": "https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-59rq-22fm-x8q5", "source": "security-advisories@github.com"}, {"url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.3.23", "source": "security-advisories@github.com"}, {"url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification. Prior to version 6.3.23, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This issue has been patched in release 6.3.23. No known workarounds are available."}, {"lang": "es", "value": "El repositorio HL7 FHIR Core Artifacts proporciona el c\u00f3digo de manejo de objetos b\u00e1sicos de Java, con utilidades (incluido el validador), para la especificaci\u00f3n de recursos de interoperabilidad r\u00e1pida de atenci\u00f3n m\u00e9dica (FHIR). Antes de la versi\u00f3n 6.3.23, las transformaciones XSLT realizadas por varios componentes son vulnerables a las inyecciones de entidades externas de XML. Un archivo XML procesado con una etiqueta DTD maliciosa podr\u00eda producir XML que contenga datos del sistema host. Esto afecta los casos de uso en los que se utiliza org.hl7.fhir.core dentro de un host donde los clientes externos pueden enviar XML. Este problema se ha corregido en la versi\u00f3n 6.3.23. No hay workarounds disponibles."}], "lastModified": "2026-06-17T07:53:58.130", "sourceIdentifier": "security-advisories@github.com"}