DDFFileParser in eclipse leshan is vulnerable to XXE Attacks
Priority MEDIUM 43CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser` and `DefaultDDFFileValidator` (and so `ObjectLoader`) are vulnerable to `XXE Attacks`. A DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if they parse untrusted DDF files (e.g. if they let external users provide their own model), in that case they MUST upgrade to fixed version. If you parse only trusted DDF file and validate only with trusted xml schema, upgrading is not mandatory. This issue has been fixed in versions 1.5.0 and 2.0.0-M13. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0069 53rd percentileScored 2026-11-07
Fix Fixed leshan (eclipse-leshan): 1.5.0, 2.0.0-M13org.eclipse.leshan:leshan-core (Maven): 1.5.0, 2.0.0-M13
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| eclipse-leshan | leshan | before 1.5.0; 2.0.0-M1 to before 2.0.0-M13 | 1.5.0, 2.0.0-M13 | Patch available | CNA |
| — | org.eclipse.leshan:leshan-core (Maven) | before 1.5.0 | 1.5.0 | Patch available | GHSA-wc9j-gc65-3cm7 |
| — | org.eclipse.leshan:leshan-core (Maven) | 2.0.0-M1 to before 2.0.0-M13 | 2.0.0-M13 | Patch available | GHSA-wc9j-gc65-3cm7 |
- leshan Vendoreclipse-leshan Affected before 1.5.0; 2.0.0-M1 to before 2.0.0-M13 Fixed in 1.5.0, 2.0.0-M13 Patch available CNA
- org.eclipse.leshan:leshan-core (Maven) Vendor— Affected before 1.5.0 Fixed in 1.5.0 Patch available GHSA-wc9j-gc65-3cm7
- org.eclipse.leshan:leshan-core (Maven) Vendor— Affected 2.0.0-M1 to before 2.0.0-M13 Fixed in 2.0.0-M13 Patch available GHSA-wc9j-gc65-3cm7
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:leshan:*:*:*:*:*:*:*:* | before 1.5.0 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:leshan:2.0.0:milestone1:*:*:*:*:*:* | 2.0.0 milestone1 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:leshan:2.0.0:milestone10:*:*:*:*:*:* | 2.0.0 milestone10 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:leshan:2.0.0:milestone11:*:*:*:*:*:* | 2.0.0 milestone11 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:leshan:2.0.0:milestone12:*:*:*:*:*:* | 2.0.0 milestone12 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:leshan:2.0.0:milestone2:*:*:*:*:*:* | 2.0.0 milestone2 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:leshan:2.0.0:milestone3:*:*:*:*:*:* | 2.0.0 milestone3 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:leshan:2.0.0:milestone4:*:*:*:*:*:* | 2.0.0 milestone4 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:leshan:2.0.0:milestone5:*:*:*:*:*:* | 2.0.0 milestone5 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:leshan:2.0.0:milestone6:*:*:*:*:*:* | 2.0.0 milestone6 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:leshan:*:*:*:*:*:*:*:* Versions before 1.5.0 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:leshan:2.0.0:milestone1:*:*:*:*:*:* Versions 2.0.0 milestone1 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:leshan:2.0.0:milestone10:*:*:*:*:*:* Versions 2.0.0 milestone10 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:leshan:2.0.0:milestone11:*:*:*:*:*:* Versions 2.0.0 milestone11 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:leshan:2.0.0:milestone12:*:*:*:*:*:* Versions 2.0.0 milestone12 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:leshan:2.0.0:milestone2:*:*:*:*:*:* Versions 2.0.0 milestone2 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:leshan:2.0.0:milestone3:*:*:*:*:*:* Versions 2.0.0 milestone3 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:leshan:2.0.0:milestone4:*:*:*:*:*:* Versions 2.0.0 milestone4 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:leshan:2.0.0:milestone5:*:*:*:*:*:* Versions 2.0.0 milestone5 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:leshan:2.0.0:milestone6:*:*:*:*:*:* Versions 2.0.0 milestone6 Vulnerable ·Eclipse Foundation
Show 3 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:leshan:2.0.0:milestone7:*:*:*:*:*:* | 2.0.0 milestone7 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:leshan:2.0.0:milestone8:*:*:*:*:*:* | 2.0.0 milestone8 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:leshan:2.0.0:milestone9:*:*:*:*:*:* | 2.0.0 milestone9 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:leshan:2.0.0:milestone7:*:*:*:*:*:* Versions 2.0.0 milestone7 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:leshan:2.0.0:milestone8:*:*:*:*:*:* Versions 2.0.0 milestone8 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:leshan:2.0.0:milestone9:*:*:*:*:*:* Versions 2.0.0 milestone9 Vulnerable ·Eclipse Foundation
Remediation
- Fix · CNA leshan (eclipse-leshan) Fixed in 1.5.0, 2.0.0-M13
- Fix · GHSA-wc9j-gc65-3cm7 org.eclipse.leshan:leshan-core (Maven) Fixed in 1.5.0 Advisory →
- Fix · GHSA-wc9j-gc65-3cm7 org.eclipse.leshan:leshan-core (Maven) Fixed in 2.0.0-M13 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-41034
- 2026-10-03 Alias added: GHSA-wc9j-gc65-3cm7
References
Patch 2
Advisory 2
Sources
- CVE-2023-41034 · CVE Program
- CVE-2023-41034 · NVD
- FIRST EPSS
- GHSA-wc9j-gc65-3cm7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences