description: In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved.
problem types: CWE-611
affected:
{
product: Eclipse Lyo
vendor: The Eclipse Foundation
versions:
lessThan: unspecified, status: affected, version: 1.0.0, versionType: custom
lessThanOrEqual: 4.1.0, status: affected, version: unspecified, versionType: custom
}