CVE-2024-28168

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.

This issue affects Apache XML Graphics FOP: 2.9.

Users are recommended to upgrade to version 2.10, which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

VendorProductVersions
Apache Software FoundationApache XML Graphics FOP2.9
apachexml_graphics_fop2.9

References

Timeline

Published
Oct 9, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-281695.4Cleartext transmission of sensitive information for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticatCVE-2024-28176.5A vulnerability, which was classified as problematic, has been found in Tenda AC15 15.03.05.18. Affected by this issue is the function fromSCVE-2024-281705.5Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable information disclosuCVE-2024-281718.1It is possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exisCVE-2024-281727.3Uncontrolled search path for some Intel(R) Trace Analyzer and Collector software before version 2022.1 may allow an authenticated user to poCVE-2024-281734.3In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosedCVE-2024-281745.8In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperlyCVE-2024-281755.4Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in CVE-2024-281765.9jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSOCVE-2024-281799.8Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated weCVE-2024-28186.5An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versioCVE-2024-281804.3Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JW
CVE-2024-28168: High severity, CVSS 7.5 | Vulnix