CVE-2024-45294

Description

### Impact XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( `<!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]>` could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. ### Patches This issue has been patched in release 6.3.23 ### Workarounds None. ### References [MITRE CWE](https://cwe.mitre.org/data/definitions/611.html) [OWASP XML External Entity Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#transformerfactory)

How to fix CVE-2024-45294

To remediate CVE-2024-45294, upgrade the affected package to a fixed version below.

—upgrade to 6.3.23 or later
—upgrade to 6.3.23 or later
—upgrade to 6.3.23 or later
—upgrade to 6.3.23 or later
—upgrade to 6.3.23 or later
—upgrade to 6.3.23 or later

Is CVE-2024-45294 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (6)

from 0, < 6.3.23
from 0, < 6.3.23
from 0, < 6.3.23
from 0, < 6.3.23
from 0, < 6.3.23
from 0, < 6.3.23

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
osv	CVSS 3.1	HIGH8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N