CVE-2024-51132

Description

An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.

How to fix CVE-2024-51132

To remediate CVE-2024-51132, upgrade the affected package to a fixed version below.

• Maven/ca.uhn.hapi.fhir:org.hl7.fhir.convertors—upgrade to 6.4.0 or later
• —upgrade to 6.4.0 or later
• —upgrade to 6.4.0 or later
• —upgrade to 6.4.0 or later
• —upgrade to 6.4.0 or later
• —upgrade to 6.4.0 or later
• —upgrade to 6.4.0 or later
• —upgrade to 6.4.0 or later
• —upgrade to 6.4.0 or later

Is CVE-2024-51132 being exploited?

Moderate — EPSS is 7.9%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (9)

• from 0, < 6.4.0
• from 0, < 6.4.0
• from 0, < 6.4.0
• from 0, < 6.4.0
• from 0, < 6.4.0
• from 0, < 6.4.0
• from 0, < 6.4.0
• from 0, < 6.4.0
• from 0, < 6.4.0

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-51132
• PATCHgithub.com/hapifhir/org.hl7.fhir.core
• WEBgithub.com/hapifhir/org.hl7.fhir.core/commit/7ede053a5fca50cc2802884c661a241d51703a67
• WEBgithub.com/JAckLosingHeart/CVE-2024-51132-POC