Every CVE Search/ Get API key

CVE-2024-52007

XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

8.6 HighFix available

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This is related to GHSA-6cr6-ph3p-f5rf, in which its fix (#1571 & #1717) was incomplete. This issue has been addressed in release version 6.4.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.90%Up 0.9 points since Nov 9, 2024
90%50%10%1%

What each source reports

CVE List Score used 8.6

XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This is related to GHSA-6cr6-ph3p-f5rf, in which its fix (#1571 & #1717) was incomplete. This issue has been addressed in release version 6.4.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2024-52007
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-611
Updated
2026-11-02
EUVDEUVD-2024-3256 8.6

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This is related to GHSA-6cr6-ph3p-f5rf, in which its fix (#1571 & #1717) was incomplete. This issue has been addressed in release version 6.4.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
EUVD-2024-3256
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-gr3c-q7xf-47vh 7.7

XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

Summary

XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML.

Details

This is related to https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf, in which its fix ( https://github.com/hapifhir/org.hl7.fhir.core/issues/1571, https://github.com/hapifhir/org.hl7.fhir.core/pull/1717) was incomplete.

References

https://cwe.mitre.org/data/definitions/611.html https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j

Record
GHSA-gr3c-q7xf-47vh
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-611
Updated
2026-11-02
NVD 8.6

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This is related to GHSA-6cr6-ph3p-f5rf, in which its fix (#1571 & #1717) was incomplete. This issue has been addressed in release version 6.4.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2024-52007
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-611
Updated
2026-11-02
OSV 8.6

XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This is related to GHSA-6cr6-ph3p-f5rf, in which its fix (#1571 & #1717) was incomplete. This issue has been addressed in release version 6.4.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2024-52007
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-611
Updated
2026-11-02
OSVGHSA-gr3c-q7xf-47vh 7.7

XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

Summary

XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML.

Details

This is related to https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf, in which its fix ( https://github.com/hapifhir/org.hl7.fhir.core/issues/1571, https://github.com/hapifhir/org.hl7.fhir.core/pull/1717) was incomplete.

References

https://cwe.mitre.org/data/definitions/611.html https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j

Record
GHSA-gr3c-q7xf-47vh
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-611
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2024-52007 No score

CVE-2024-52007 in ca.uhn.hapi.fhir:org.hl7.fhir.utilities - Patched by Root

Root has patched CVE-2024-52007 in the ca.uhn.hapi.fhir:org.hl7.fhir.utilities package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2024-52007
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3
Maven
 before 6.4.0
6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.r4
Maven
 before 6.4.0
6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.r4b
Maven
 before 6.4.0
6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.r5
Maven
 before 6.4.0
6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.utilities
Maven
 before 6.4.0
6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may
Maven
 before 6.4.0
6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3
Maven
 before 6.4.0, plus listed versions
0.0.10.0.140.0.20.1.181.0.0
Show 45 moreShow less
1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7
6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.r4
Maven
 before 6.4.0, plus listed versions
0.0.10.0.140.0.20.1.181.0.0
Show 45 moreShow less
1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7
6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.r4b
Maven
 before 6.4.0, plus listed versions
5.6.1005.6.1015.6.1025.6.1035.6.104
Show 45 moreShow less
5.6.1055.6.1065.6.1075.6.1085.6.1095.6.1105.6.1115.6.1125.6.1135.6.1145.6.1155.6.1165.6.1175.6.225.6.235.6.245.6.255.6.265.6.275.6.285.6.295.6.305.6.315.6.325.6.335.6.345.6.355.6.365.6.375.6.385.6.395.6.405.6.415.6.425.6.435.6.445.6.455.6.465.6.475.6.485.6.505.6.515.6.525.6.535.6.54
6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.r5
Maven
 before 6.4.0, plus listed versions
0.0.10.0.140.0.20.1.181.0.0
Show 45 moreShow less
1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7
6.4.0
Show 14 moreShow less
Affected packages
PackageAffectedFixed
ca.uhn.hapi.fhir:org.hl7.fhir.utilities
Maven
 before 6.4.0, plus listed versions
0.0.10.0.140.0.20.1.181.0.0
Show 45 moreShow less
1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7
6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may
Maven
 before 6.4.0, plus listed versions
0.0.10.0.140.0.20.1.181.0.0
Show 45 moreShow less
1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7
6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.utilities
Root:Maven
 before 6.0.1-aikido.2
6.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.4.0-aikido.16.4.0-aikido.2
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may
Root:Maven
 before 6.0.1-aikido.2
6.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.4.0-aikido.16.4.0-aikido.2
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3
Root:Maven
 before 6.0.1-aikido.2
6.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.4.0-aikido.16.4.0-aikido.2
ca.uhn.hapi.fhir:org.hl7.fhir.r4
Root:Maven
 before 6.0.1-aikido.2
6.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.4.0-aikido.16.4.0-aikido.2
ca.uhn.hapi.fhir:org.hl7.fhir.r4b
Root:Maven
 before 6.0.1-aikido.2
6.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.4.0-aikido.2
ca.uhn.hapi.fhir:org.hl7.fhir.r5
Root:Maven
 before 6.0.1-aikido.2
6.0.1-aikido.26.0.1-aikido.36.0.1-aikido.46.4.0-aikido.16.4.0-aikido.2
io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities
Root:Maven
 before 6.0.1-root.io.2
6.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.4.0-root.io.16.4.0-root.io.2
io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may
Root:Maven
 before 6.0.1-root.io.2
6.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.4.0-root.io.16.4.0-root.io.2
io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu3
Root:Maven
 before 6.0.1-root.io.2
6.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.4.0-root.io.16.4.0-root.io.2
io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r4
Root:Maven
 before 6.0.1-root.io.2
6.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.4.0-root.io.16.4.0-root.io.2
io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r4b
Root:Maven
 before 6.0.1-root.io.2
6.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.4.0-root.io.2
io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r5
Root:Maven
 before 6.0.1-root.io.2
6.0.1-root.io.26.0.1-root.io.36.0.1-root.io.46.4.0-root.io.16.4.0-root.io.2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-52007 is a high vulnerability (CVSS 8.6) in Hapifhir Org.hl7.fhir.core, published November 8, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 59th percentile. Fixed in ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 6.4.0.

References

Show 4 moreShow less
This page doesn't list everything

Left out here: 1,499 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open