CVE-2021-41411

Description

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.301

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-41411 are fixed in Drools-drools-core 7.60.0	Windows
Vulnerabilities CVE-2021-41411 are fixed in Drools-drools-core for Linux 7.60.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234