CVE-2023-48362

Description

XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue.

Problem types

CWE-611 Improper Restriction of XML External Entity Reference

Product status

Credits

Yuzhe Huang 0x4007872880

References

https://lists.apache.org/thread/9tt0q4bdjwgw0dz0l9knqxjnpb5y6zsl vendor-advisory

http://www.openwall.com/lists/oss-security/2024/07/24/3

cve.org CVE-2023-48362

nvd.nist.gov CVE-2023-48362

Download JSON