CoreCVE
Back

HIGH

PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets) to perform information disclosure, denial of service, or request forgery attacks

Published Feb 11, 2019

Description

PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets) to perform information disclosure, denial of service, or request forgery attacks. (PMD 6.x is unaffected because of a 2017-09-15 change.)

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-611

XXE

References (3)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Feb 11, 2019
Updated Aug 4, 2024
Reserved Feb 11, 2019
Link CVE-2019-7722
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-7722
Red Hat
Severity n/a
Public date n/a
Links CVE-2019-7722
GHSA-57QJ-79GH-69W8