Description

The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.7.4, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag `( ]>` could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.publisher is being used to within a host where external clients can submit XML. A previous release provided an incomplete solution revealed by new testing. This issue has been patched as of version 1.7.4. No known workarounds are available.

INFO

Published Date :

2025-01-24T18:34:23.255Z

Last Modified :

2026-01-28T23:21:13.318Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2024-52807 vulnerability.

Vendors Products
Hl7
  • Fhir Ig Publisher
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-52807.

URL Resource
https://github.com/HL7/fhir-ig-publisher/commit/3560de2f486d688a3ddcf4aa54d8bdacea380c3d cve-icon cve-icon
https://github.com/HL7/fhir-ig-publisher/compare/1.7.3...1.7.4 cve-icon cve-icon
https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-8c3x-hq82-gjcm cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact