XML External Entity Reference in apache jena
Date: 2022-05
Affected: maven/org.apache.jena:jena
Attack vector: other
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2022-28890
CWE: CWE-611
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 only. Apache Jena 4.2.x and 4.3.x do not allow external entities.


Mitigations:

Architectural layers (MAESTRO):