Jaxb Ri Core
Monthly
Out-of-band XML External Entity (XXE) injection in Eclipse JAXB RI (jaxb-ri) lets an unauthenticated remote attacker read local files when an application unmarshals attacker-influenced XML through the affected JAXB factory helpers (XmlFactory in the core and xsom modules). The pre-patch code relied solely on XMLConstants.FEATURE_SECURE_PROCESSING, so on JAXP/SAX/DocumentBuilder implementations where that single feature does not disable DOCTYPE declarations, external general entities, external parameter entities, or external DTD loading, external entity resolution remains possible and file content can be exfiltrated out-of-band. Exploitation requires both conditions to hold - untrusted XML reaching JAXB unmarshalling, plus a parser stack where secure processing alone is insufficient - which is why the vector carries AC:H and the score is 8.3 (High) on both the supplied CVSS 4.0 vector and the independently assessed CVSS 3.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L). No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis.
Out-of-band XML External Entity (XXE) injection in Eclipse JAXB RI (jaxb-ri) lets an unauthenticated remote attacker read local files when an application unmarshals attacker-influenced XML through the affected JAXB factory helpers (XmlFactory in the core and xsom modules). The pre-patch code relied solely on XMLConstants.FEATURE_SECURE_PROCESSING, so on JAXP/SAX/DocumentBuilder implementations where that single feature does not disable DOCTYPE declarations, external general entities, external parameter entities, or external DTD loading, external entity resolution remains possible and file content can be exfiltrated out-of-band. Exploitation requires both conditions to hold - untrusted XML reaching JAXB unmarshalling, plus a parser stack where secure processing alone is insufficient - which is why the vector carries AC:H and the score is 8.3 (High) on both the supplied CVSS 4.0 vector and the independently assessed CVSS 3.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L). No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis.