CVE-2024-34345 @cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability
An attacker can exploit XML External Entity injection in the CycloneDX JavaScript library's validator to read sensitive data or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-34345?
CVE-2024-34345 is a high-severity vulnerability in cyclonedx-javascript-library, published on 9 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1.
Weakness: CWE-611
Which versions are affected by CVE-2024-34345?
2 open source packages ship an affected version, including @cyclonedx/cyclonedx-library.
| Package | Affected | Fixed in |
|---|---|---|
@cyclonedx/cyclonedx-library npm | From 6.7.0 | 6.7.1 |
@cyclonedx/cyclonedx-library npm | From 6.7.0 | 6.7.1 |
How do I fix CVE-2024-34345?
Upgrade @cyclonedx/cyclonedx-library to 6.7.1 or later.
Is CVE-2024-34345 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-34345 exists.
Sources
Also known as GHSA-38gf-rh2w-gmj7.