{"action":"Upgrade com.fasterxml.jackson.dataformat:jackson-dataformat-xml to 2.7.4 or later.","affected":[{"fixed":"2.7.4","introduced":"0"}],"component":"com.fasterxml.jackson.dataformat:jackson-dataformat-xml","cve_ids":["CVE-2016-3720"],"ecosystem":"Maven","epss":0.0278,"exploited":false,"fixed_versions":["2.7.4"],"ghsa_id":"GHSA-hmq6-frv3-4727","id":"tcs_01M5N90YT7EX38DHG556MGAD0G","modified_at":"2023-11-08T03:58:27.329295Z","published_at":"2018-10-18T17:43:16Z","references":["https://osv.dev/vulnerability/GHSA-hmq6-frv3-4727","https://nvd.nist.gov/vuln/detail/CVE-2016-3720","https://github.com/advisories/GHSA-hmq6-frv3-4727","http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184561.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-hmq6-frv3-4727","url":"https://osv.dev/vulnerability/GHSA-hmq6-frv3-4727"}],"summary":"jackson-dataformat-xml vulnerable to XML external entity (XXE)"}