XML Injection (aka Blind XPath Injection)
CVE-2024-28109
Summary
The veraPDF-library is a PDF/A validation library. Executing policy checks using custom "schematron" files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This issue affects the packages org.verapdf:core and org.verapdf:core-jakarta versions prior to 1.24.2.
- LOW
- NETWORK
- HIGH
- UNCHANGED
- NONE
- LOW
- HIGH
- NONE
CWE-91 - XML Injection (aka Blind XPath Injection)
The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
References
Advisory Timeline
- Published
