`org.hl7.fhir.core` XXE vulnerability in XSLT transforms
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.3.23
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification. Prior to version 6.3.23, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This issue has been patched in release 6.3.23. No known workarounds are available.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- hapifhir org.hl7.fhir.core
fixed in 6.3.23
- ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016mayMaven
fixed in 6.3.23
- ca.uhn.hapi.fhir:org.hl7.fhir.dstu3Maven
fixed in 6.3.23
- ca.uhn.hapi.fhir:org.hl7.fhir.r4Maven
fixed in 6.3.23
- ca.uhn.hapi.fhir:org.hl7.fhir.r4bMaven
fixed in 6.3.23
- ca.uhn.hapi.fhir:org.hl7.fhir.r5Maven
fixed in 6.3.23
- ca.uhn.hapi.fhir:org.hl7.fhir.utilitiesMaven
fixed in 6.3.23