The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. This vulnerability has been fixed in cyclonedx-core-java version 9.0.4.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.cyclonedx:cyclonedx-core-java(Maven) | 2.1.0 | 9.0.4 | N/A |
CVSS Metrics
