CVE-2024-51132 — Vulnerability in ca.uhn.hapi.fhir:org.hl7.fhir.r4...

HIGH

HAPI FHIR XML External Entity (XXE) vulnerability

Published November 5, 2024Updated November 6, 2024Source: osv

Summary

An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.

Advisory Timeline

First published November 5, 2024 (706 days ago).
Last revised November 6, 2024 — 1 day after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.r4 to 6.4.0 or later

<!-- Update pom.xml dependency version to 6.4.0 for ca.uhn.hapi.fhir:org.hl7.fhir.r4 -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.validation to 6.4.0 or later

<!-- Update pom.xml dependency version to 6.4.0 for ca.uhn.hapi.fhir:org.hl7.fhir.validation -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.utilities to 6.4.0 or later

<!-- Update pom.xml dependency version to 6.4.0 for ca.uhn.hapi.fhir:org.hl7.fhir.utilities -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.convertors to 6.4.0 or later

<!-- Update pom.xml dependency version to 6.4.0 for ca.uhn.hapi.fhir:org.hl7.fhir.convertors -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.r4b to 6.4.0 or later

<!-- Update pom.xml dependency version to 6.4.0 for ca.uhn.hapi.fhir:org.hl7.fhir.r4b -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to 6.4.0 or later

<!-- Update pom.xml dependency version to 6.4.0 for ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to 6.4.0 or later

<!-- Update pom.xml dependency version to 6.4.0 for ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 to 6.4.0 or later

<!-- Update pom.xml dependency version to 6.4.0 for ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.r5 to 6.4.0 or later

<!-- Update pom.xml dependency version to 6.4.0 for ca.uhn.hapi.fhir:org.hl7.fhir.r5 -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (9)

Affects 1 ecosystem: maven (9).

Package	Ecosystem	Affected	Fixed In
ca.uhn.hapi.fhir:org.hl7.fhir.r4	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+317 more)	6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.validation	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+317 more)	6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.utilities	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+317 more)	6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.convertors	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+317 more)	6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.r4b	maven	5.6.100, 5.6.101, 5.6.102, 5.6.103 (+190 more)	6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+317 more)	6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+317 more)	6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+317 more)	6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.r5	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+317 more)	6.4.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-601
Open RedirectMITRE
CWE-611
XML External Entity (XXE)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2024-51132?: HAPI FHIR XML External Entity (XXE) vulnerability This vulnerability has been assigned a severity rating of HIGH (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2024-51132?: CVE-2024-51132 affects ca.uhn.hapi.fhir:org.hl7.fhir.r4, ca.uhn.hapi.fhir:org.hl7.fhir.validation and ca.uhn.hapi.fhir:org.hl7.fhir.utilities (and 6 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-51132 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-4cf2-cxp3-rjr7

Related CVEs

CVE-2026-55471
CRITICAL
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
CVE-2023-24057
CRITICAL
MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core`
CVE-2026-33180
CRITICAL
HAPI FHIR HTTP authentication leak in redirects
CVE-2026-34361
CRITICAL
FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
CVE-2026-45367
HIGH
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
CVE-2024-45294
HIGH
XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`
CVE-2026-49485
HIGH
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
CVE-2024-52007
HIGH
XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies