Details
-
Sub-task
-
Status: Resolved
-
Critical
-
Resolution: Fixed
-
8.8.x
-
None
Description
https://github.com/rpastrana/HPCC4J/security/code-scanning/5
Parsing untrusted XML files with a weakly configured XML parser may lead to an XML External Entity (XXE) attack. This type of attack uses external entity references to access arbitrary files on a system, carry out denial of service, or server side request forgery. Even when the result of parsing is not returned to the user, out-of-band data retrieval techniques may allow attackers to steal sensitive data. Denial of services can also be carried out in this situation.