{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"5.8.19"}],"component":"cn.hutool:hutool-core","cve_ids":["CVE-2023-3276"],"ecosystem":"Maven","epss":0.00726,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-p2qf-9vp6-3jjq","id":"tcs_01M5N967BJ6RYN3BAV5P3DXS90","modified_at":"2024-03-01T14:46:11.705975Z","published_at":"2023-06-15T15:30:15Z","references":["https://osv.dev/vulnerability/GHSA-p2qf-9vp6-3jjq","https://nvd.nist.gov/vuln/detail/CVE-2023-3276","https://fbdhhhh47.github.io/2023/06/06/hutool-XXE","https://github.com/dromara/hutool","https://vuldb.com/?ctiid.231626","https://vuldb.com/?id.231626"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-p2qf-9vp6-3jjq","url":"https://osv.dev/vulnerability/GHSA-p2qf-9vp6-3jjq"}],"summary":"HuTool XML parsing module has blind XXE vulnerability"}