kritisch
CVE-2024-51132
org.hl7.fhir.convertors: org.hl7.fhir.dstu2: org.hl7.fhir.dstu2016may: org.hl7.fhir.dstu3: org.hl7.fhir.r4: org.hl7.fhir.r5: org.hl7.fhir.utilities: org.hl7.fhir.validation: org.hl7.fhir.core: FHIR arbitrary code execution via specially-crafted request
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
GHSA8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Red Hat9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut Red Hat. Niedriger laut GHSA (hoch).
Beschreibung
An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.convertors, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may und 6 weitere | 6.4.0 |
Alle 9 Einträge aus 1 Quelle zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.convertors | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r4 | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r4b | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r5 | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.utilities | 6.4.0 |
| maven::GitHub Security Advisory Maven | ca.uhn.hapi.fhir:org.hl7.fhir.validation | 6.4.0 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2024-51132
- https://docs.redhat.com/en/documentation/red_hat_build_of_apache_camel_k/1.10.8/html/release_notes_for_red_hat_build_of_apache_camel_k/camel-k-relnotes_camelk#supported_camel_quarkus_connector_extensions
- https://github.com/JAckLosingHeart/CVE-2024-51132-POC
- https://github.com/advisories/GHSA-4cf2-cxp3-rjr7
- https://github.com/hapifhir/org.hl7.fhir.core
- https://github.com/hapifhir/org.hl7.fhir.core/commit/7ede053a5fca50cc2802884c661a241d51703a67
- https://nvd.nist.gov/vuln/detail/CVE-2024-51132
- https://www.cve.org/CVERecord?id=CVE-2024-51132