CVE-2023-49733: Apache Cocoon Improper Restriction of XML External Entity Reference vulnerability
Summary
CVE-2023-49733: Apache Cocoon Improper Restriction of XML External Entity Reference vulnerability. Affects org.apache.cocoon:cocoon versions >= 2.2.0, < 2.3.0. Fixed in 2.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Cocoon is an open-source web development framework that focuses on content-centric applications. It provides a powerful environment for building web applications using XML, XSLT, and other technologies. This vulnerability affects Apache Cocoon versions 2.2.0 to 2.3.0.
Vulnerability Detail
The vulnerability in Apache Cocoon is due to an improper restriction of XML external entity references. This issue allows an attacker to exploit XML parsing functionality and potentially access sensitive information or execute arbitrary code. It poses a moderate risk to systems running affected versions of Apache Cocoon.
How To Fix
Latest published version: 9 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the Apache Cocoon Improper Restriction of XML External Entity Reference vulnerability poses a moderate risk to systems running affected versions of Apache Cocoon. Users should upgrade to version 2.3.0 to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cocoon:cocoon →
FAQ
Apache Cocoon is an open-source web development framework that focuses on content-centric applications. It provides a powerful environment for building web applications using XML, XSLT, and other technologies.
This vulnerability allows an attacker to exploit XML parsing functionality and potentially access sensitive information or execute arbitrary code.
Versions 2.2.0 to 2.3.0 of Apache Cocoon are affected by this vulnerability.
To fix this vulnerability, upgrade to version 2.3.0 of Apache Cocoon.
No, upgrading to version 2.3.0 is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cocoon:cocoon.
