XML External Entity (XXE) in Talend/components (master)

Issue Details

• Vulnerability: XML External Entity (XXE)
• Severity: High
• Project: Talend/components
• Branch: master
• Scan Date: Unknown

Issue Description

Calcite Core is vulnerable to XML external entity attacks. A remote attacker is able to read the contents of confidential files through the use of SQL functions such as `EXISTS_NODE`, `EXTRACT_XML`, `XML_TRANSFORM` or `EXTRACT_VALUE` due to insecure business logic in `XmlFunctions.java`.

View more details