CVE-2023-3276
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A vulnerability has been found in Dromara HuTool up to version 5.8.19 in the function readBySax of the file XmlUtil.java, leading to XML external entity reference. The issue has been disclosed publicly and may be exploited.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access to data or XML External Entity (XXE) attacks, posing a serious security threat to the application.
Recommendation
It is recommended to update Dromara HuTool to the latest version to mitigate this vulnerability and to monitor systems for potential exploitation attempts.
Original NVD description (English source)
A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclosed to the public and may be used. VDB-231626 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.