PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets) to perform information disclosure, denial of service, or request forgery attacks. (PMD 6.x is unaffected because of a 2017-09-15 change.)

Published : 2019-02-11 14:29 Updated : 2019-02-21 15:01

CVSS Score More info
Score 6.8 / 10
Vendor Product Version URI
Pmd Project Pmd 5.8.1 cpe:/a:pmd_project:pmd:5.8.1
  1. Pmd Project (1) Search CVE
    1. Pmd (1) Search CVE
      1. 5.8.1


ID Name Description Links
CWE-611 Improper Restriction of XML External Entity Reference ('XXE') The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. CVE


History of changes

Date Event
2019-02-21 15:01
2019-02-11 14:29