« Volver al listado

CVE-2024-31573

Estado: AplazadaMedia (4)—

XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Xmlunit — Xmlunit FOR JavaAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-31573",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-31573",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-10-17T19:03:35.746491Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 1.4
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "XMLUnit",
          "product": "XMLUnit for Java",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "2.10.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-10-17T19:15:36.627",
  "references": [
    {
      "url": "https://github.com/advisories/GHSA-chfm-68vv-pvw5",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/xmlunit/xmlunit/commit/b81d48b71dfd2868bdfc30a3e17ff973f32bc15b",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/xmlunit/xmlunit/issues/264",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/xmlunit/xmlunit/issues/264",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-669"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled."
    },
    {
      "lang": "es",
      "value": "XMLUnit para Java anterior a 2.10.0, en la configuración predeterminada, podría permitir la ejecución de código a través de una hoja de estilo no confiable (utilizada para una transformación XSLT), porque las funciones de extensión XSLT están habilitadas."
    }
  ],
  "lastModified": "2026-10-02T00:10:00.180",
  "sourceIdentifier": "cve@mitre.org"
}