Improper Restriction of XML External Entity Reference in PMD

published 2019-02-11 7 y ago modified 2026-06-17 4 mo ago also GHSA-57qj-79gh-69w8 , EUVD-2022-2524

cvss: 8.1; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 69%
public exploits: 0; none known

PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets) to perform information disclosure, denial of service, or request forgery attacks. (PMD 6.x is unaffected because of a 2017-09-15 change.)

Patch / fix

fixed in 1

maven net.sourceforge.pmd:pmd-core 6.0.0

Exploit prediction

1.23% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/pmd/pmd/issues/1650 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.0	8.1	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub	3.0	8.1	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	net.sourceforge.pmd:pmd-core	<6.0.0	6.0.0

Classification

Weakness

CWE-611 Improper Restriction of XML External Entity Reference

References

github.com /pmd/pmd/issues/1650
web, exploit, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2019-7722
advisory
github.com /pmd/pmd
package

Sources

CVE List CVE-2019-7722
GitHub Advisory GHSA-57qj-79gh-69w8
NVD CVE-2019-7722

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary