Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2023-48362
CVE-2023-48362:
Java vulnerability analysis and mitigation
Overview
XXE vulnerability (CVE-2023-48362) was discovered in Apache Drill's XML Format Plugin affecting versions 1.19.0 and greater. The vulnerability was disclosed and tracked as DRILL-8461, with a fix released in version 1.21.2. The issue was discovered by Yuzhe Huang and is classified as having moderate severity (OSS Security).
Technical details
The vulnerability is an XML External Entity (XXE) injection flaw present in the XML Format Plugin component of Apache Drill. This type of vulnerability occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser (CVE Mitre).
Impact
If exploited, this vulnerability allows an attacker to read arbitrary files from the remote file system or execute commands through a specially crafted malicious XML file (OSS Security).
Mitigation and workarounds
Users are strongly recommended to upgrade to Apache Drill version 1.21.2, which contains the fix for this vulnerability (OSS Security).
Additional resources
Source: This report was generated using AI
Related Java vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management