XXE in Pmd Project
CVE-2019-7722
PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets) to perform information disclosure, denial of service, or request forgery attacks. (PMD 6.x is unaffected because of a 2017-09-15 change.)
Vulnerability class: XXE (XML External Entity)
EPSS: 0.012 (65.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Pmd_project Pmd
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2019-7722?
- CVE-2019-7722 is a high-severity vulnerability in Pmd Project, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 8.1/10. Published 2019-02-11.
- How severe is CVE-2019-7722?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2019-7722 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.