XXE vulnerability in Eclipse JGit (Eclipse JGit Eclipse JGit)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.84 % · percentile 58 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- eclipse
- NVD status
- Analyzed
Description
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.
Weaknesses (CWE)
- CWE-611 — Improper Restriction of XML External Entity Reference
- CWE-827 — Improper Control of Document Type Definition
References
- https://projects.eclipse.org/projects/technology.jgit/releases/7.2.1
- https://projects.eclipse.org/projects/technology.jgit/releases/7.1.1
- https://projects.eclipse.org/projects/technology.jgit/releases/7.0.1
- https://projects.eclipse.org/projects/technology.jgit/releases/6.10.1
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281
- https://gitlab.eclipse.org/security/cve-assignement/-/issues/64
- https://projects.eclipse.org/projects/technology.jgit/releases/5.13.4
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 6.8 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:Y/R:U/V:D/RE:L/U:Green | eclipse |
| CVSS 4.0 | MEDIUM 6.8 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:L/U:Green | NVD · emo@eclipse.org (Secondary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-vrpq-qp53-qv56 — Eclipse JGit XML External Entity (XXE) Vulnerability
European references
- ENISA EUVD · EUVD-2025-15988
- GCVE · GCVE-0-2025-4949
CERT-FR advisories
- CERTFR-2025-AVI-0905 — Multiples vulnérabilités dans Oracle Database Server · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0622 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:*< 5.13.4cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.10.1.202505221210cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:*≥ 7.0.0 < 7.0.1.202505221510cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:*≥ 7.1.0 < 7.1.1.202505221757cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:*≥ 7.2.0 < 7.2.1.202505142326
Affected products
| Product | Versions |
|---|---|
| Eclipse JGit · Eclipse JGit | affected 7.2.0 < 7.2.1.202505142326-r ; affected 7.1.0 < 7.1.1.202505221757-r ; affected 7.0.0 < 7.0.1.202505221510-r ; affected 0 < 5.13.4.202507202350-r ; affected 6.0.0 < 6.10.1.202505221210-r |
| Eclipse JGit · Eclipse JGit | affected 7.2.0 < 7.2.1.202505142326-r ; affected 7.1.0 < 7.1.1.202505221757-r ; affected 7.0.0 < 7.0.1.202505221510-r ; affected 0 < 5.13.4.202507202350-r ; affected 6.0.0 < 6.10.1.202505221210-r |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |