QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2025-4949

Back to search

CVE-2025-4949

Published: May 21, 2025

Modified: Oct 14, 2025

PUBLISHED

Description

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.

VendorProductVersions

Eclipse JGit

Eclipse JGit

affected
7.2.0 - < 7.2.1.202505142326-r
affected
7.1.0 - < 7.1.1.202505221757-r
affected
7.0.0 - < 7.0.1.202505221510-r
affected
0 - < 5.13.4.202507202350-r
affected
6.0.0 - < 6.10.1.202505221210-r

Eclipse JGit

Eclipse JGit

affected
7.2.0 - < 7.2.1.202505142326-r
affected
7.1.0 - < 7.1.1.202505221757-r
affected
7.0.0 - < 7.0.1.202505221510-r
affected
0 - < 5.13.4.202507202350-r
affected
6.0.0 - < 6.10.1.202505221210-r

Weaknesses (CWE)

CWE-611
CWE-827

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now