CVE-2023-48362

{"id": "CVE-2023-48362", "cveTags": [], "metrics": {}, "published": "2024-07-24T08:15:02.627", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/07/24/3", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/9tt0q4bdjwgw0dz0l9knqxjnpb5y6zsl", "source": "security@apache.org"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Primary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file.\nUsers are recommended to upgrade to version 1.21.2, which fixes this issue."}, {"lang": "es", "value": "XXE en el complemento de formato XML en Apache Drill versi\u00f3n 1.19.0 y superior permite al usuario leer cualquier archivo en un sistema de archivos remoto o ejecutar comandos a trav\u00e9s de un archivo XML malicioso. Se recomienda a los usuarios actualizar a la versi\u00f3n 1.21.2, que soluciona este problema."}], "lastModified": "2024-07-24T14:15:05.180", "sourceIdentifier": "security@apache.org"}