Skip to content
OpenAdvisories
Critical · 9.8 CVE-2023-49733 EUVD-2023-2906GHSA-77jg-cpw9-73vg

Apache Cocoon's StreamGenerator is vulnerable to XXE injection

Published Nov 30, 2023 · Updated Feb 13, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Cocoon Package: org.apache.cocoon:cocoon Ecosystem: Maven

Description

Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0.

Users are recommended to upgrade to version 2.3.0, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Cocoon 2.2.0 – < 2.3.0 2.3.0

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.cocoon:cocoon >= 2.2.0, < 2.3.0 2.3.0 GHSA-77jg-cpw9-73vg

References