XXE in Cyclonedx Cyclonedx-javascript-library
CVE-2024-34345
The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in…
Vulnerability class: XXE (XML External Entity)
EPSS: 0.009 (56.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Cyclonedx Cyclonedx-javascript-library — versions = 6.7.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-34345?
- CVE-2024-34345 is a high-severity vulnerability in Cyclonedx Cyclonedx-javascript-library, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 8.1/10. Published 2024-05-14.
- How severe is CVE-2024-34345?
- High severity. CVSS v3 base score is 8.1 out of 10.