CVE-2024-31573

Publication date 17 October 2025

Last updated 29 October 2025

Ubuntu priority

Cvss 3 Severity Score

Description

XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
xmlunit	26.04 LTS resolute	Needs evaluation
	25.10 questing	Needs evaluation
	25.04 plucky	Ignored end of life, was needs-triage
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation

How can I get the fixes?
What do statuses mean?

Severity score breakdown

Parameter	Value
Base score	4.0 · Medium
Attack vector	Local
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity impact	Low
Availability impact	None
Vector	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

MITRE
NVD
Launchpad
Debian

Other references

https://www.cve.org/CVERecord?id=CVE-2024-31573
https://github.com/advisories/GHSA-chfm-68vv-pvw5
https://github.com/xmlunit/xmlunit/issues/264
https://github.com/xmlunit/xmlunit/commit/b81d48b71dfd2868bdfc30a3e17ff973f32bc15b (v2.10.0)
https://github.com/xmlunit/xmlunit/commit/b81d48b71dfd2868bdfc30a3e17ff973f32bc15b