CVE-2021-32754: Improper Restriction of XML External Entity Reference

July 12, 2021 (updated July 15, 2021)

FlowDroid is a data flow analysis tool. FlowDroid contained an XML external entity (XXE) vulnerability that allowed an attacker who had control over the source/sink definition file in XML format to read files from external locations. In order for this to occur, the XML-based format for sources and sinks had to be used and the attacker had to able control the source/sink definition file.

References

nvd.nist.gov/vuln/detail/CVE-2021-32754

Code Behaviors & Features

Detect and mitigate CVE-2021-32754 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →