{"answers":{"affected":"18 open source packages ship an affected version, including org.verapdf:verapdf-library, org.verapdf:core and org.verapdf:core-arlington.","exploited":"There is no known exploitation of CVE-2024-52800 in the wild and no public exploit code.","fix":"Upgrade org.verapdf:verapdf-library to 1.26.2 or later.","what":"CVE-2024-52800 is a low-severity vulnerability in veraPDF-library, published on 29 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2024-52800 and fix it if it is affected.\n\nWhat it is: CVE-2024-52800 is a low-severity vulnerability in veraPDF-library, published on 29 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2024-52800 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- org.verapdf:verapdf-library (Maven): affected all versions; fixed in 1.26.2\n- org.verapdf:verapdf-library (Maven): affected all versions; fixed in 1.26.2\n- org.verapdf:core (Maven): affected all versions; fixed in 1.26.2\n- org.verapdf:core (Maven): affected all versions; fixed in 1.26.2\n- org.verapdf:core-arlington (Maven): affected all versions; fixed in 1.26.2\n- org.verapdf:core-arlington (Maven): affected all versions; fixed in 1.26.2\n- org.verapdf:core-jakarta (Maven): affected all versions; fixed in 1.26.2\n- org.verapdf:core-jakarta (Maven): affected all versions; fixed in 1.26.2\n- org.verapdf:library (Maven): affected all versions; fixed in 1.26.2\n- org.verapdf:library (Maven): affected all versions; fixed in 1.26.2\n- org.verapdf:library-arlington (Maven): affected all versions; fixed in 1.26.2\n- org.verapdf:library-arlington (Maven): affected all versions; fixed in 1.26.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-52800/ (Markdown: https://insights.sbomify.com/CVE-2024-52800/index.md)","id":"CVE-2024-52800","markdown":"https://insights.sbomify.com/CVE-2024-52800/index.md","name":"CVE-2024-52800","record":{"aliases":["GHSA-4cx5-89vm-833x"],"analysis":{"component_type":"library","fix_type":"no_fix_stated","impacts":["code_execution"],"network_reachable":"yes","non_default_config":true,"product_category":"PDF validation library","requires_auth":"none","summary":"Attackers can achieve remote code execution via XXE in veraPDF CLI when processing untrusted custom Schematron files.","user_interaction":"required","vuln_class":"xxe"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":2.3,"severity":"low","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference"}],"description":"veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. This issue has not yet been patched. Users are advised to be cautious of XSLT code until a patch is available.","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":"2024-11-30","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2024-11-30T06:55:07Z","kind":"github_poc","ref":"https://github.com/JAckLosingHeart/GHSA-4cx5-89vm-833x-POC","stars":0,"title":"GHSA-4cx5-89vm-833x/CVE-2024-52800"}],"tier":"poc_unverified"},"has_fix":true,"headline":"Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI","id":"CVE-2024-52800","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":null,"products":[],"type":"xxe","year":"2024"},"n_packages":18,"n_references":2,"next":{"headline":"Brute force takeover of OpenID Connect session cookies in sftpgo","id":"CVE-2024-52801"},"packages":[{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:core","purl":null,"source":"GHSA-4cx5-89vm-833x"},{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:core","purl":"pkg:maven/org.verapdf/core","source":"GHSA-4cx5-89vm-833x"},{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:core-arlington","purl":null,"source":"GHSA-4cx5-89vm-833x"},{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:core-arlington","purl":"pkg:maven/org.verapdf/core-arlington","source":"GHSA-4cx5-89vm-833x"},{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:core-jakarta","purl":null,"source":"GHSA-4cx5-89vm-833x"},{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:core-jakarta","purl":"pkg:maven/org.verapdf/core-jakarta","source":"GHSA-4cx5-89vm-833x"},{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:library","purl":null,"source":"GHSA-4cx5-89vm-833x"},{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:library","purl":"pkg:maven/org.verapdf/library","source":"GHSA-4cx5-89vm-833x"},{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:library-arlington","purl":null,"source":"GHSA-4cx5-89vm-833x"},{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:library-arlington","purl":"pkg:maven/org.verapdf/library-arlington","source":"GHSA-4cx5-89vm-833x"},{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:library-jakarta","purl":null,"source":"GHSA-4cx5-89vm-833x"},{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:library-jakarta","purl":"pkg:maven/org.verapdf/library-jakarta","source":"GHSA-4cx5-89vm-833x"},{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:verapdf-library","purl":null,"source":"GHSA-4cx5-89vm-833x"},{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:verapdf-library","purl":"pkg:maven/org.verapdf/verapdf-library","source":"GHSA-4cx5-89vm-833x"},{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:verapdf-library-arlington","purl":null,"source":"GHSA-4cx5-89vm-833x"},{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:verapdf-library-arlington","purl":"pkg:maven/org.verapdf/verapdf-library-arlington","source":"GHSA-4cx5-89vm-833x"},{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:verapdf-library-jakarta","purl":null,"source":"GHSA-4cx5-89vm-833x"},{"ecosystem":"Maven","fixed":["1.26.2"],"introduced":["0"],"last_affected":[],"package":"org.verapdf:verapdf-library-jakarta","purl":"pkg:maven/org.verapdf/verapdf-library-jakarta","source":"GHSA-4cx5-89vm-833x"}],"prev":{"headline":"Argo Workflows Chart: Excessive Privileges in Workflow Role","id":"CVE-2024-52799"},"products":["veraPDF-library"],"published":"2024-11-29","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-12-02","vendors":["veraPDF"]},"summary":"Attackers can achieve remote code execution via XXE in veraPDF CLI when processing untrusted custom Schematron files.","url":"https://insights.sbomify.com/CVE-2024-52800/"}