CVE-2024-51132
| Severity | 9.8 Critical CVSS 3.1 |
|---|---|
| Fixed in | 6.4.0 |
| Weakness | XML external entity (XXE) (CWE-611) |
| Published | 5 Nov 2024 |
| Updated | 17 Jun 2026 |
Description
An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.
CWE-601
Exploitation status
Proof of concept only
A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: poc CISA recorded that an exploit has been demonstrated. Automatable: yes, technical impact: total.
- Indexed PoC 1 indexed, none at 5+ stars
- EPSS 1.9% chance in 30 days
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | JAckLosingHeart/CVE-2024-51132-POC | 1 | 2024-11-02 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full XXE
- Action available security rule
- Review automated Inferred
- Record active
| Decided by | A vulnerability class already blocked by an ARMR security rule |
|---|---|
| Finding | Protected by Waratek's ARMR xxe security rule, which blocks this class of attack at the JVM level without a rule written for this CVE specifically. The CVE's weakness is CWE-611: XML External Entity Reference. |
How to mitigate CVE-2024-51132
Upgrade the affected software to 6.4.0 or later. Until you can, Waratek RASP blocks exploitation with its XXE rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
ca.uhn.hapi.fhir:org.hl7.fhir.convertors |
0 | 6.4.0 |
unbounded |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 |
0 | 6.4.0 |
unbounded |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may |
0 | 6.4.0 |
unbounded |
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 |
0 | 6.4.0 |
unbounded |
ca.uhn.hapi.fhir:org.hl7.fhir.r4 |
0 | 6.4.0 |
unbounded |
ca.uhn.hapi.fhir:org.hl7.fhir.r4b |
0 | 6.4.0 |
unbounded |
ca.uhn.hapi.fhir:org.hl7.fhir.r5 |
0 | 6.4.0 |
unbounded |
ca.uhn.hapi.fhir:org.hl7.fhir.utilities |
0 | 6.4.0 |
unbounded |
ca.uhn.hapi.fhir:org.hl7.fhir.validation |
0 | 6.4.0 |
unbounded |
Products and versions
9 products, 9 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| osv | ca.uhn.hapi.fhir | org.hl7.fhir.convertors | generic | ＜ 6.4.0 |
| osv | ca.uhn.hapi.fhir | org.hl7.fhir.dstu2 | generic | ＜ 6.4.0 |
| osv | ca.uhn.hapi.fhir | org.hl7.fhir.dstu2016may | generic | ＜ 6.4.0 |
| osv | ca.uhn.hapi.fhir | org.hl7.fhir.dstu3 | generic | ＜ 6.4.0 |
| osv | ca.uhn.hapi.fhir | org.hl7.fhir.r4 | generic | ＜ 6.4.0 |
| osv | ca.uhn.hapi.fhir | org.hl7.fhir.r4b | generic | ＜ 6.4.0 |
| osv | ca.uhn.hapi.fhir | org.hl7.fhir.r5 | generic | ＜ 6.4.0 |
| osv | ca.uhn.hapi.fhir | org.hl7.fhir.utilities | generic | ＜ 6.4.0 |
| osv | ca.uhn.hapi.fhir | org.hl7.fhir.validation | generic | ＜ 6.4.0 |
References
Timeline
Timeline
| Published | 2024-11-05 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |