{"id":"CVE-2024-58335","details":"OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualization/VisualizerImpl.java.","modified":"2026-08-12T14:52:22.665917Z","published":"2025-12-24T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58335.json","unresolved_ranges":[{"extracted_events":[{"fixed":"6c50e8979924b09f336c976cbad3a9ebfe25ebf9"}],"source":"AFFECTED_FIELD"},{"source":"DESCRIPTION","extracted_events":[{"fixed":"6c50e89"}]}],"cna_assigner":"mitre","cwe_ids":["CWE-611"]},"references":[{"type":"WEB","url":"https://invoice.secvuln.info"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58335.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58335"},{"type":"FIX","url":"https://github.com/jcthiele/OpenXRechnungToolbox/commit/6c50e8979924b09f336c976cbad3a9ebfe25ebf9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jcthiele/openxrechnungtoolbox","events":[{"introduced":"0"},{"fixed":"af3e7c5ae2b82f28b0f9b86067b60a274b6488f8"},{"fixed":"6c50e8979924b09f336c976cbad3a9ebfe25ebf9"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2024-10-05-3.0.0"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["2024-10-05-3.0.0","2024-10-04-3.0.0","2022-01-30-1.1.3","2022-01-30","2022-01-07","2021-02-20","2020-11-02","2020-08-28","2020-08-27"],"database_specific":{"vanir_signatures":[{"target":{"file":"src/main/java/org/oxt/toolbox/gui/AppWindow.java"},"deprecated":false,"digest":{"line_hashes":["91797500357706959924864477200561147273","82509016349328873696626803610256440111","245107789898109304860774089559344343394","134030634419679524552221438038342412700","32962626881013786279000217023905627270","34925208322954662780403110163092612853","28490661720774307120701672956704723961","107298274943060978014211737023153452330","80580582192370686760043056980858526391","136559286233646843645082503687270341219","327824987242838160559591443509799312296","97152458038604442721128527377966017357"],"threshold":0.9},"id":"CVE-2024-58335-5580f3e5","signature_type":"Line","signature_version":"v1","source":"https://github.com/jcthiele/openxrechnungtoolbox/commit/af3e7c5ae2b82f28b0f9b86067b60a274b6488f8"},{"deprecated":false,"digest":{"function_hash":"279669923180599808064853919494802203845","length":4230},"id":"CVE-2024-58335-7b1c438d","signature_type":"Function","signature_version":"v1","source":"https://github.com/jcthiele/openxrechnungtoolbox/commit/af3e7c5ae2b82f28b0f9b86067b60a274b6488f8","target":{"function":"main","file":"src/main/java/org/oxt/toolbox/gui/AppWindow.java"}},{"id":"CVE-2024-58335-8b7c9ce3","signature_type":"Function","signature_version":"v1","source":"https://github.com/jcthiele/openxrechnungtoolbox/commit/6c50e8979924b09f336c976cbad3a9ebfe25ebf9","target":{"file":"src/main/java/org/oxt/toolbox/visualization/VisualizerImpl.java","function":"xsltTransformationFromStringWriter"},"deprecated":false,"digest":{"function_hash":"135909173686231881855504909569538957878","length":557}},{"deprecated":false,"digest":{"line_hashes":["9432205948509338417827718264121970748","124127463788678294553700431816112564725","238114869201622947979670670152317924232","169317099862735224096945059384580184108","13651817299829584518405290267341685011","201992976830863104942285700442950842948","66213062299927042290783232880627834705","186211273429314880795922747392516243740","272387255340619825255196243675669910089","307335764006965151638752718621354950308","294544188066198699689729227135813529989","18647826803584612515082456354978722861","222423373171099673302632883197955776963","78248550583327622458870526680891929645","19556189292209570462442653570741178863","96010537811942127021765088113039058396"],"threshold":0.9},"id":"CVE-2024-58335-f70f3549","signature_type":"Line","signature_version":"v1","source":"https://github.com/jcthiele/openxrechnungtoolbox/commit/6c50e8979924b09f336c976cbad3a9ebfe25ebf9","target":{"file":"src/main/java/org/oxt/toolbox/visualization/VisualizerImpl.java"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58335.json","vanir_signatures_modified":"2026-08-12T14:52:22Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"}]}