CVE-2023-49733 Apache Cocoon's StreamGenerator is vulnerable to XXE injection
Attackers can exploit XML External Entity injection in Apache Cocoon's StreamGenerator to read sensitive data or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-49733?
CVE-2023-49733 is a critical vulnerability in Apache Cocoon, published on 30 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0.
Users are recommended to upgrade to version 2.3.0, which fixes the issue.
Weakness: CWE-611
Which versions are affected by CVE-2023-49733?
2 open source packages ship an affected version, including org.apache.cocoon:cocoon. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.cocoon:cocoon Maven | From 2.2.0 | 2.3.0 |
org.apache.cocoon:cocoon Maven | From 2.2.0 | 2.3.0 |
Products include Apache Cocoon.
How do I fix CVE-2023-49733?
Upgrade org.apache.cocoon:cocoon to 2.3.0 or later.
Is CVE-2023-49733 being exploited?
There is no known exploitation of CVE-2023-49733 in the wild and no public exploit code.
Other vulnerabilities in Apache Cocoon
Sources
Also known as GHSA-77jg-cpw9-73vg.