Apache Ivy: XML External Entity vulnerability in Apache Ivy

CVE-2022-46751

What is CVE-2022-46751?

The vulnerability in Apache Ivy allows unauthorized access to external document type definitions when parsing XML files, potentially leading to data exfiltration and disruption of the application's execution. This flaw affects all versions prior to 2.5.2 and can be exploited by manipulating entity references within XML files, enabling attackers to access sensitive resources on the server. Users are encouraged to upgrade to version 2.5.2, where DTD processing has been disabled by default, thus significantly improving security.

References