CVE-2024-34345
Last modified
CVE-2024-34345 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. EPSS estimates a 0.92% chance of exploitation in the next 30 days.
Description
The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-34345?
How severe is CVE-2024-34345?
How do I fix CVE-2024-34345?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-3434A vulnerability classified as critical was found in CP Plus …5.4
- CVE-2024-34340Cacti provides an operational monitoring and fault managemen…9.1
- CVE-2024-34341Trix is a rich text editor. The Trix editor, versions prior …5.4
- CVE-2024-34342react-pdf displays PDFs in React apps. If PDF.js is used to …7.1
- CVE-2024-34343Nuxt is a free and open-source framework to create full-stac…6.1
- CVE-2024-34344Nuxt is a free and open-source framework to create full-stac…8.8
- CVE-2024-34346Deno is a JavaScript, TypeScript, and WebAssembly runtime wi…9
- CVE-2024-34347@hoppscotch/cli is a CLI to run Hoppscotch Test Scripts in C…8.3
- CVE-2024-34349Sylius is an open source eCommerce platform. Prior to 1.12.1…4.8
- CVE-2024-3435A path traversal vulnerability exists in the 'save_settings'…8.4
- CVE-2024-34350Next.js is a React framework that can provide building block…7.5
- CVE-2024-34351Next.js is a React framework that can provide building block…7.5
Are you affected by CVE-2024-34345?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST