CVE-2019-7722 Improper Restriction of XML External Entity Reference in PMD

High 8.1 Published 11 Feb 2019 Updated 4 Aug 2024

Attackers can exploit XML external entity processing in PMD rulesets to disclose information or cause denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-7722?

CVE-2019-7722 is a high-severity vulnerability in n/a, published on 11 Feb 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets) to perform information disclosure, denial of service, or request forgery attacks. (PMD 6.x is unaffected because of a 2017-09-15 change.)

Weakness: CWE-611

Which versions are affected by CVE-2019-7722?

2 open source packages ship an affected version, including net.sourceforge.pmd:pmd-core. It affects 1 product.

Package	Affected	Fixed in
`net.sourceforge.pmd:pmd-core` Maven	All versions	`6.0.0`
`net.sourceforge.pmd:pmd-core` Maven	All versions	`6.0.0`

Products include Pmd Project Pmd.

How do I fix CVE-2019-7722?

Upgrade net.sourceforge.pmd:pmd-core to 6.0.0 or later.

Is CVE-2019-7722 being exploited?

There is no known exploitation of CVE-2019-7722 in the wild and no public exploit code.

CVE-2026-28338 PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages Medium 6.8

Sources

Also known as GHSA-57qj-79gh-69w8.