CVE-2008-0628 XML external entity in n/a

High 7.8 Published 6 Feb 2008 Updated 7 Aug 2024

Remote attackers can exploit XML parsing flaws in Java Runtime Environment to access restricted resources or cause denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2008-0628?

CVE-2008-0628 is a high-severity vulnerability in Sun Jdk, published on 6 Feb 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The XML parsing code in Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier processes external entity references even when the "external general entities" property is false, which allows remote attackers to conduct XML external entity (XXE) attacks and cause a denial of service or access restricted resources.

Weakness: CWE-264

Which versions are affected by CVE-2008-0628?

It affects 2 products.

Products include Sun Jdk, Sun Jre.

How do I fix CVE-2008-0628?

Upgrade to a fixed version.

Is CVE-2008-0628 being exploited?

There is no known exploitation of CVE-2008-0628 in the wild and no public exploit code.

All Sun Jdk vulnerabilities

Sources

Also known as GHSA-878m-jp48-9823.