XXE Vulnerability in OpenXRechnungToolbox from JCThiele

CVE-2024-58335

What is CVE-2024-58335?

OpenXRechnungToolbox prior to commit 6c50e89 is susceptible to an XML External Entity (XXE) vulnerability due to the disallow-doctype-decl feature being disabled in the visualization/VisualizerImpl.java file. This oversight could allow attackers to exploit the parsing of XML input, leading to potential information disclosure and other security issues. Proper configuration and patching are essential to mitigate risks associated with this vulnerability.

References