Skip to content
Fencer Vulns
critical 9.8

CVE-2024-51132 json

HAPI FHIR XML External Entity (XXE) vulnerability

published 2024-11-05 2 y ago modified 2026-06-17 4 mo ago also GHSA-4cf2-cxp3-rjr7 , EUVD-2024-3191

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.9%
EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits
0
none known

Summary

An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.

Patch / fix

  • maven ca.uhn.hapi.fhir:org.hl7.fhir.convertors 6.4.0
  • maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 6.4.0
  • maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may 6.4.0
  • maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 6.4.0
  • maven ca.uhn.hapi.fhir:org.hl7.fhir.r4 6.4.0
  • maven ca.uhn.hapi.fhir:org.hl7.fhir.r4b 6.4.0
  • maven ca.uhn.hapi.fhir:org.hl7.fhir.r5 6.4.0
  • maven ca.uhn.hapi.fhir:org.hl7.fhir.utilities 6.4.0
  • maven ca.uhn.hapi.fhir:org.hl7.fhir.validation 6.4.0
  • fhir hapi_fhir 6.4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-51132 updated cvss 9.1

org.hl7.fhir.convertors: org.hl7.fhir.dstu2: org.hl7.fhir.dstu2016may: org.hl7.fhir.dstu3: org.hl7.fhir.r4: org.hl7.fhir.r5: org.hl7.fhir.utilities: org.hl7.fhir.validation: org.hl7.fhir.core: FHIR ar

  • Red Hat build of Apache Camel for Spring Boot 3 org.hl7.fhir.r4, org.hl7.fhir.r5, org.hl7.fhir.dstu2, org.hl7.fhir.dstu3, org.hl7.fhir.utilities, org.hl7.fhir.dstu2016may
    affected: workaround, no fix planned “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
  • Red Hat Fuse 7 org.hl7.fhir.r4, org.hl7.fhir.r5, org.hl7.fhir.dstu2, org.hl7.fhir.dstu3, org.hl7.fhir.utilities, org.hl7.fhir.dstu2016may, +4 more
    affected: workaround, no fix available “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
  • Red Hat Integration Camel K 1 org.hl7.fhir.r4, org.hl7.fhir.r5, org.hl7.fhir.dstu3, org.hl7.fhir.utilities
    affected: workaround, no fix planned “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
  • Red Hat Build of Apache Camel 4.4 for Quarkus 3.8
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:10035
  • Red Hat build of Apache Camel 4.4.4 for Spring Boot
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:9806

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

1.90% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven ca.uhn.hapi.fhir:org.hl7.fhir.convertors
<6.4.0
6.4.0
maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu2
<6.4.0
6.4.0
maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may
<6.4.0
6.4.0
maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu3
<6.4.0
6.4.0
maven ca.uhn.hapi.fhir:org.hl7.fhir.r4
<6.4.0
6.4.0
maven ca.uhn.hapi.fhir:org.hl7.fhir.r4b
<6.4.0
6.4.0
maven ca.uhn.hapi.fhir:org.hl7.fhir.r5
<6.4.0
6.4.0
maven ca.uhn.hapi.fhir:org.hl7.fhir.utilities
<6.4.0
6.4.0
maven ca.uhn.hapi.fhir:org.hl7.fhir.validation
<6.4.0
6.4.0

Affected products

  • fhir hapi_fhir

Classification

Weakness
  • CWE-611 Improper Restriction of XML External Entity Reference
  • CWE-601 URL Redirection to Untrusted Site

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.