Description (CNA)
OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualization/VisualizerImpl.java.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| jcthiele / OpenXRechnungToolbox | affected 0 before 6c50e8979924b09f336c976cbad3a9ebfe25ebf9 |
CWE
CWE-611
References
- https://github.com/jcthiele/OpenXRechnungToolbox/commit/6c50e8979924b09f336c976cbad3a9ebfe25ebf9
- https://invoice.secvuln.info
ADP enrichment
No English description supplied.
No references supplied.