{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-29T20:28:11.420","vulnerabilities":[{"cve":{"id":"CVE-2024-45294","sourceIdentifier":"security-advisories@github.com","published":"2024-09-06T16:15:03.300","lastModified":"2026-04-15T00:35:42.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification. Prior to version 6.3.23, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This issue has been patched in release 6.3.23. No known workarounds are available."},{"lang":"es","value":"El repositorio HL7 FHIR Core Artifacts proporciona el código de manejo de objetos básicos de Java, con utilidades (incluido el validador), para la especificación de recursos de interoperabilidad rápida de atención médica (FHIR). Antes de la versión 6.3.23, las transformaciones XSLT realizadas por varios componentes son vulnerables a las inyecciones de entidades externas de XML. Un archivo XML procesado con una etiqueta DTD maliciosa podría producir XML que contenga datos del sistema host. Esto afecta los casos de uso en los que se utiliza org.hl7.fhir.core dentro de un host donde los clientes externos pueden enviar XML. Este problema se ha corregido en la versión 6.3.23. No hay workarounds disponibles."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.0}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-611"}]}],"references":[{"url":"https://github.com/HL7/fhir-ig-publisher/releases/tag/1.6.22","source":"security-advisories@github.com"},{"url":"https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-59rq-22fm-x8q5","source":"security-advisories@github.com"},{"url":"https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.3.23","source":"security-advisories@github.com"},{"url":"https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf","source":"security-advisories@github.com"}]}}]}