CVE-2024-28168

—

CVSS 3.1

7.5 high

EPSS

1%p62

Published

Oct 9, 2024 (Oct 9, 2024)

Modified

Jun 17, 2026

Description

Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue.

Vendors: apache
Products: formatting objects processor
Weakness: CWE-611
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news0 stories

No ingested article mentions this CVE yet.