CVE-2024-31573 Security Details

CVE ID

CVE-2024-31573

CWE

CWE-669

CVE Description

XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.

Published

May 3, 2024

CVSS Score & Severity

9.2Critical

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS Score

0.036%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/custommonkey/xmlunit/XMLUnit.newTransformerFactory()Ljavax/xml/transform/TransformerFactory;

JVM

org/xmlunit/diff/DefaultComparisonFormatter.createXmlTransformer(I)Ljavax/xml/transform/Transformer;

JVM

org/xmlunit/transform/Transformation.transformTo(Ljavax/xml/transform/Result;)V

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · Issue #264PROJECT

GitHub · Advisory · GHSA-chfm-68vv-pvw5THIRD_PARTY