CVE-2024-55887

Estado: AplazadaAlta (8.6)—

Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML. Release 1.0.9 of Ucum-java fixes this vulnerability. As a workaround, ensure that the source xml for instantiating UcumEssenceService is trusted.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Puntuación base: 8.6

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.56%
Percentil entre todas las CVEs puntuadas: 45
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1005 Data from Local Systemcollection80 %

XML externo vulnerable (CWE-611) en servicio expuesto sin autenticación (AV:N, PR:N, UI:N); lee datos del host (información disclosure en DTD malicioso).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Filter Network Traffic Application Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Ucum — Ucum-java^AI

CWE

CWE-611

Referencias

https://github.com/FHIR/Ucum-java/security/advisories/GHSA-w9j7-phm3-f97j

JSON original (NVD)

Mostrar

{
  "id": "CVE-2024-55887",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-55887",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-13T17:06:02.821909Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "FHIR",
          "product": "Ucum-java",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.0.9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-12-13T16:15:28.063",
  "references": [
    {
      "url": "https://github.com/FHIR/Ucum-java/security/advisories/GHSA-w9j7-phm3-f97j",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML. Release 1.0.9 of Ucum-java fixes this vulnerability. As a workaround, ensure that the source xml for instantiating UcumEssenceService is trusted."
    },
    {
      "lang": "es",
      "value": "Ucum-java es una librería Java FHIR que proporciona servicios UCUM. En versiones anteriores a la 1.0.9, el análisis de XML realizado por UcumEssenceService es vulnerable a inyecciones de entidades externas de XML. Un archivo XML procesado con una etiqueta DTD maliciosa podría generar XML que contenga datos del sistema host. Esto afecta los casos de uso en los que se utiliza ucum dentro de un host donde los clientes externos pueden enviar XML. La versión 1.0.9 de Ucum-java corrige esta vulnerabilidad. Como workaround, asegúrese de que el XML de origen para crear una instancia de UcumEssenceService sea confiable."
    }
  ],
  "lastModified": "2026-06-17T08:11:24.583",
  "sourceIdentifier": "security-advisories@github.com"
}