CVE-2024-45294

The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification. Prior to version 6.3.23, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This issue has been patched in release 6.3.23. No known workarounds are available.

• CWE-611

• https://github.com/HL7/fhir-ig-publisher/releases/tag/1.6.22
• https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-59rq-22fm-x8q5
• https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.3.23
• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf

Published

Sep 6, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45289The fetch(3) library uses environment variables for passing …7.5
• CVE-2024-4529The Business Card WordPress plugin through 1.0.0 does not ha…5
• CVE-2024-45290PHPSpreadsheet is a pure PHP library for reading and writing…7.5
• CVE-2024-45291PHPSpreadsheet is a pure PHP library for reading and writing…8.8
• CVE-2024-45292PHPSpreadsheet is a pure PHP library for reading and writing…5.4
• CVE-2024-45293PHPSpreadsheet is a pure PHP library for reading and writing…7.5
• CVE-2024-45295Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-45296path-to-regexp turns path strings into a regular expressions…7.5
• CVE-2024-45297Discourse is an open source platform for community discussio…4.3
• CVE-2024-45298Wiki.js is an open source wiki app built on Node.js. A disab…4.3
• CVE-2024-45299alf.io is an open source ticket reservation system for confe…6.5
• CVE-2024-4530The Business Card WordPress plugin through 1.0.0 does not ha…6.3