TopVuln

High-risk vulnerability digests

CVE-2025-4949

  • MEDIUM

Critical: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.17 security update

Details

CVSS v3
5.3
CVSS v4
6.8
NVD published
2025-05-21 07:16:01
EPSS
0.2% probability · 41.6th percentile — 2026-03-29
Affected versions
cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:* cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:* cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:* cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:* cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:*
Summary
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.
Remediation
Not available in our cache.
Exploit info
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281

View on NVD

TopVuln sends digest emails with high-risk CVE picks across multiple authoritative sources—curated with EPSS and AI. Choose daily per-stream emails and optional weekly or monthly roundups.

Subscribe — free email digest or paid plan

Information is aggregated from multiple authoritative sources for convenience; verify with NVD and vendors before operational decisions.