← Back to CVE List

CVE-2024-38374

Published: 2024-06-28T18:15Z
Last Modified: 2024-11-21T09:25Z
Source: MITRE CVE List
License: MITRE-CVE-TOS
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. This vulnerability has been fixed in cyclonedx-core-java version 9.0.4. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt