Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-51132
CVE-2024-51132:
Java vulnerability analysis and mitigation
Overview
An XML External Entity (XXE) vulnerability was discovered in HAPI FHIR before version 6.4.0. The vulnerability was identified in multiple artifacts within the org.hl7.fhir.core repository, affecting various modules including org.hl7.fhir.convertors, org.hl7.fhir.dstu2, org.hl7.fhir.dstu2016may, org.hl7.fhir.dstu3, org.hl7.fhir.r4, org.hl7.fhir.r4b, org.hl7.fhir.r5, org.hl7.fhir.utilities, and org.hl7.fhir.validation (MITRE CVE, NVD).
Technical details
The vulnerability is classified as an XML External Entity (XXE) injection issue that allows attackers to access sensitive information or execute arbitrary code through crafted requests containing malicious XML entities. The vulnerability has received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating its severe nature. The issue is tracked under CWE-611 (Improper Restriction of XML External Entity Reference) (CISA-ADP).
Impact
The vulnerability can be exploited to perform various malicious activities including unauthorized access to sensitive information and arbitrary code execution. The high CVSS score indicates that successful exploitation could lead to complete system compromise, with potential impacts on the confidentiality, integrity, and availability of the affected systems (Red Hat Advisory).
Mitigation and workarounds
The primary mitigation is to upgrade HAPI FHIR to version 6.4.0 or later, which contains the fix for this vulnerability. The fix has been implemented across all affected modules in the org.hl7.fhir.core repository (HAPI FHIR Core).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management