Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2024-51132

26
FAUCET Score

CVE-2024-51132 is a critical XML External Entity (XXE) vulnerability affecting HAPI FHIR versions prior to 6.4.0, allowing unauthenticated attackers to achieve remote code execution or sensitive information disclosure through crafted XML requests. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network with no user interaction required, leading to high impact on confidentiality, integrity, and availability. While no public exploits or active exploitation have been observed, and community discussion is minimal, its critical severity and ease of exploitation warrant immediate patching.

Impacted Technologies

VendorProductVersion(s)CPE
N/AN/A
n/aCNA affected

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.85%
Probability of exploitation in next 30 days
EPSS Percentile
76.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0185 is in the 65th percentile among its peer group of 36,897 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (31)

mavenpatch availablevia ghsa
Product: ca.uhn.hapi.fhir:org.hl7.fhir.convertorsFixed in: 6.4.0
mavenpatch availablevia ghsa
Product: ca.uhn.hapi.fhir:org.hl7.fhir.dstu2Fixed in: 6.4.0
mavenpatch availablevia ghsa
Product: ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016mayFixed in: 6.4.0
mavenpatch availablevia ghsa
Product: ca.uhn.hapi.fhir:org.hl7.fhir.dstu3Fixed in: 6.4.0
mavenpatch availablevia ghsa
Product: ca.uhn.hapi.fhir:org.hl7.fhir.r4Fixed in: 6.4.0
mavenpatch availablevia ghsa
Product: ca.uhn.hapi.fhir:org.hl7.fhir.r4bFixed in: 6.4.0
mavenpatch availablevia ghsa
Product: ca.uhn.hapi.fhir:org.hl7.fhir.r5Fixed in: 6.4.0
mavenpatch availablevia ghsa
Product: ca.uhn.hapi.fhir:org.hl7.fhir.utilitiesFixed in: 6.4.0
mavenpatch availablevia ghsa
Product: ca.uhn.hapi.fhir:org.hl7.fhir.validationFixed in: 6.4.0
redhatpatch availablevia redhat_api
Product: Red Hat build of Apache Camel 4.4.4 for Spring BootFixed in: ca.uhn.hapi.fhir/org.hl7.fhir.dstu2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat build of Apache Camel 4.4.4 for Spring BootFixed in: ca.uhn.hapi.fhir/org.hl7.fhir.dstu2016may
View patch
redhatpatch availablevia redhat_api
Product: Red Hat build of Apache Camel 4.4.4 for Spring BootFixed in: ca.uhn.hapi.fhir/org.hl7.fhir.dstu3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat build of Apache Camel 4.4.4 for Spring BootFixed in: ca.uhn.hapi.fhir/org.hl7.fhir.r4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat build of Apache Camel 4.4.4 for Spring BootFixed in: ca.uhn.hapi.fhir/org.hl7.fhir.r5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat build of Apache Camel 4.4.4 for Spring BootFixed in: ca.uhn.hapi.fhir/org.hl7.fhir.utilities
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Build of Apache Camel 4.4 for Quarkus 3.8Fixed in: ca.uhn.hapi.fhir/org.hl7.fhir.dstu2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Build of Apache Camel 4.4 for Quarkus 3.8Fixed in: ca.uhn.hapi.fhir/org.hl7.fhir.dstu2016may
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Build of Apache Camel 4.4 for Quarkus 3.8Fixed in: ca.uhn.hapi.fhir/org.hl7.fhir.dstu3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Build of Apache Camel 4.4 for Quarkus 3.8Fixed in: ca.uhn.hapi.fhir/org.hl7.fhir.r4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Build of Apache Camel 4.4 for Quarkus 3.8Fixed in: ca.uhn.hapi.fhir/org.hl7.fhir.r5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Build of Apache Camel 4.4 for Quarkus 3.8Fixed in: ca.uhn.hapi.fhir-org.hl7.fhir.utilities
View patch
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: ca.uhn.hapi.fhir/org.hl7.fhir.convertors
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: ca.uhn.hapi.fhir-org.hl7.fhir.core
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: ca.uhn.hapi.fhir/org.hl7.fhir.dstu2
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: ca.uhn.hapi.fhir/org.hl7.fhir.dstu2016may
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: ca.uhn.hapi.fhir/org.hl7.fhir.dstu3
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: ca.uhn.hapi.fhir/org.hl7.fhir.r4
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: ca.uhn.hapi.fhir/org.hl7.fhir.r5
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: ca.uhn.hapi.fhir/org.hl7.fhir.utilities
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: ca.uhn.hapi.fhir/org.hl7.fhir.validation
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: ca.uhn.hapi.fhir/org.hl7.fhir.validation.cli

Vendor Advisories (2)

mavenGHSA-4cf2-cxp3-rjr7high

HAPI FHIR XML External Entity (XXE) vulnerability

Nov 5, 2024
redhatCVE-2024-51132Critical

org.hl7.fhir.convertors: org.hl7.fhir.dstu2: org.hl7.fhir.dstu2016may: org.hl7.fhir.dstu3: org.hl7.fhir.r4: org.hl7.fhir.r5: org.hl7.fhir.utilities: org.hl7.fhir.validation: org.hl7.fhir.core: FHIR arbitrary code execution via specially-crafted request

Nov 5, 2024

References

github.com / hapifhir/org.hl7.fhir.core
github.com / JAckLosingHeart/CVE-2024-51132-POC